FusionOS-SA-2023-2001 Moderate FusionOS CVE-2022-44267:ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin input. CVE-2022-44268:ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it). FusionOS ImageMagick-7.1.0.28-6.u1.fos23.x86_64.rpm ImageMagick-devel-7.1.0.28-6.u1.fos23.x86_64.rpm ImageMagick-help-7.1.0.28-6.u1.fos23.x86_64.rpm ImageMagick-perl-7.1.0.28-6.u1.fos23.x86_64.rpm ImageMagick-c++-7.1.0.28-6.u1.fos23.x86_64.rpm ImageMagick-c++-devel-7.1.0.28-6.u1.fos23.x86_64.rpm ImageMagick-7.1.0.28-6.u1.fos23.aarch64.rpm ImageMagick-devel-7.1.0.28-6.u1.fos23.aarch64.rpm ImageMagick-help-7.1.0.28-6.u1.fos23.aarch64.rpm ImageMagick-perl-7.1.0.28-6.u1.fos23.aarch64.rpm ImageMagick-c++-7.1.0.28-6.u1.fos23.aarch64.rpm ImageMagick-c++-devel-7.1.0.28-6.u1.fos23.aarch64.rpm FusionOS-SA-2023-2002 Important FusionOS CVE-2022-4743:A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected. FusionOS SDL2-2.0.12-5.u1.fos23.x86_64.rpm SDL2-devel-2.0.12-5.u1.fos23.x86_64.rpm SDL2-static-2.0.12-5.u1.fos23.x86_64.rpm SDL2-2.0.12-5.u1.fos23.aarch64.rpm SDL2-devel-2.0.12-5.u1.fos23.aarch64.rpm SDL2-static-2.0.12-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2003 Moderate FusionOS CVE-2022-37704:Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which may lead to escalation of privileges, denial of service, and information disclosure. CVE-2022-37705:A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar with specific arguments that are controllable by the attacker. This program mishandles the arguments passed to tar binary (it expects that the argument name and value are separated with a space; however, separating them with an equals sign is also supported), FusionOS amanda-3.5.1-23.u2.fos23.x86_64.rpm amanda-help-3.5.1-23.u2.fos23.noarch.rpm amanda-3.5.1-23.u2.fos23.aarch64.rpm FusionOS-SA-2023-2004 Important FusionOS CVE-2023-24998:Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured. FusionOS apache-commons-fileupload-1.4-2.u1.fos23.noarch.rpm apache-commons-fileupload-help-1.4-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2005 Critical FusionOS CVE-2022-24963:Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0. FusionOS apr-1.7.0-6.u1.fos23.x86_64.rpm apr-devel-1.7.0-6.u1.fos23.x86_64.rpm apr-help-1.7.0-6.u1.fos23.noarch.rpm apr-1.7.0-6.u1.fos23.aarch64.rpm apr-devel-1.7.0-6.u1.fos23.aarch64.rpm FusionOS-SA-2023-2006 Critical FusionOS CVE-2022-25147:Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions. FusionOS apr-util-1.6.1-14.u1.fos23.x86_64.rpm apr-util-devel-1.6.1-14.u1.fos23.x86_64.rpm apr-util-pgsql-1.6.1-14.u1.fos23.x86_64.rpm apr-util-odbc-1.6.1-14.u1.fos23.x86_64.rpm apr-util-1.6.1-14.u1.fos23.aarch64.rpm apr-util-devel-1.6.1-14.u1.fos23.aarch64.rpm apr-util-pgsql-1.6.1-14.u1.fos23.aarch64.rpm apr-util-odbc-1.6.1-14.u1.fos23.aarch64.rpm FusionOS-SA-2023-2007 Important FusionOS CVE-2022-41704:A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16. CVE-2022-42890:A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16. FusionOS batik-1.10-8.u1.fos23.noarch.rpm batik-help-1.10-8.u1.fos23.noarch.rpm FusionOS-SA-2023-2008 Critical FusionOS CVE-2021-33641:When processing files, malloc stores the data of the current line. When processing comments, malloc incorrectly accesses the released memory (use after free). CVE-2021-33642:When a file is processed, an infinite loop occurs in next_inline() of the more_curly() function. FusionOS byacc-2.0.20210808-4.u1.fos23.x86_64.rpm byacc-help-2.0.20210808-4.u1.fos23.noarch.rpm byacc-2.0.20210808-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2009 Moderate FusionOS CVE-2022-4904:A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity. FusionOS c-ares-1.18.1-5.u2.fos23.x86_64.rpm c-ares-devel-1.18.1-5.u2.fos23.x86_64.rpm c-ares-help-1.18.1-5.u2.fos23.noarch.rpm c-ares-1.18.1-5.u2.fos23.aarch64.rpm c-ares-devel-1.18.1-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2010 Important FusionOS CVE-2022-3650:A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root in the form of a crash dump, and dump privileged information. FusionOS ceph-16.2.7-14.u6.fos23.x86_64.rpm ceph-base-16.2.7-14.u6.fos23.x86_64.rpm cephadm-16.2.7-14.u6.fos23.noarch.rpm ceph-common-16.2.7-14.u6.fos23.x86_64.rpm ceph-mds-16.2.7-14.u6.fos23.x86_64.rpm ceph-mon-16.2.7-14.u6.fos23.x86_64.rpm ceph-mgr-16.2.7-14.u6.fos23.x86_64.rpm ceph-mgr-dashboard-16.2.7-14.u6.fos23.noarch.rpm ceph-mgr-diskprediction-local-16.2.7-14.u6.fos23.noarch.rpm ceph-mgr-modules-core-16.2.7-14.u6.fos23.noarch.rpm ceph-mgr-rook-16.2.7-14.u6.fos23.noarch.rpm ceph-mgr-k8sevents-16.2.7-14.u6.fos23.noarch.rpm ceph-mgr-cephadm-16.2.7-14.u6.fos23.noarch.rpm ceph-fuse-16.2.7-14.u6.fos23.x86_64.rpm cephfs-mirror-16.2.7-14.u6.fos23.x86_64.rpm rbd-fuse-16.2.7-14.u6.fos23.x86_64.rpm rbd-mirror-16.2.7-14.u6.fos23.x86_64.rpm ceph-immutable-object-cache-16.2.7-14.u6.fos23.x86_64.rpm rbd-nbd-16.2.7-14.u6.fos23.x86_64.rpm ceph-radosgw-16.2.7-14.u6.fos23.x86_64.rpm cephfs-top-16.2.7-14.u6.fos23.noarch.rpm ceph-osd-16.2.7-14.u6.fos23.x86_64.rpm librados2-16.2.7-14.u6.fos23.x86_64.rpm librados-devel-16.2.7-14.u6.fos23.x86_64.rpm libradospp-devel-16.2.7-14.u6.fos23.x86_64.rpm librgw2-16.2.7-14.u6.fos23.x86_64.rpm librgw-devel-16.2.7-14.u6.fos23.x86_64.rpm python3-rgw-16.2.7-14.u6.fos23.x86_64.rpm python3-rados-16.2.7-14.u6.fos23.x86_64.rpm libcephsqlite-16.2.7-14.u6.fos23.x86_64.rpm libcephsqlite-devel-16.2.7-14.u6.fos23.x86_64.rpm librbd1-16.2.7-14.u6.fos23.x86_64.rpm librbd-devel-16.2.7-14.u6.fos23.x86_64.rpm python3-rbd-16.2.7-14.u6.fos23.x86_64.rpm libcephfs2-16.2.7-14.u6.fos23.x86_64.rpm libcephfs-devel-16.2.7-14.u6.fos23.x86_64.rpm python3-cephfs-16.2.7-14.u6.fos23.x86_64.rpm python3-ceph-argparse-16.2.7-14.u6.fos23.x86_64.rpm python3-ceph-common-16.2.7-14.u6.fos23.x86_64.rpm ceph-test-16.2.7-14.u6.fos23.x86_64.rpm rados-objclass-devel-16.2.7-14.u6.fos23.x86_64.rpm ceph-grafana-dashboards-16.2.7-14.u6.fos23.noarch.rpm ceph-prometheus-alerts-16.2.7-14.u6.fos23.noarch.rpm ceph-16.2.7-14.u6.fos23.aarch64.rpm ceph-base-16.2.7-14.u6.fos23.aarch64.rpm ceph-common-16.2.7-14.u6.fos23.aarch64.rpm ceph-mds-16.2.7-14.u6.fos23.aarch64.rpm ceph-mon-16.2.7-14.u6.fos23.aarch64.rpm ceph-mgr-16.2.7-14.u6.fos23.aarch64.rpm ceph-fuse-16.2.7-14.u6.fos23.aarch64.rpm cephfs-mirror-16.2.7-14.u6.fos23.aarch64.rpm rbd-fuse-16.2.7-14.u6.fos23.aarch64.rpm rbd-mirror-16.2.7-14.u6.fos23.aarch64.rpm ceph-immutable-object-cache-16.2.7-14.u6.fos23.aarch64.rpm rbd-nbd-16.2.7-14.u6.fos23.aarch64.rpm ceph-radosgw-16.2.7-14.u6.fos23.aarch64.rpm ceph-osd-16.2.7-14.u6.fos23.aarch64.rpm librados2-16.2.7-14.u6.fos23.aarch64.rpm librados-devel-16.2.7-14.u6.fos23.aarch64.rpm libradospp-devel-16.2.7-14.u6.fos23.aarch64.rpm librgw2-16.2.7-14.u6.fos23.aarch64.rpm librgw-devel-16.2.7-14.u6.fos23.aarch64.rpm python3-rgw-16.2.7-14.u6.fos23.aarch64.rpm python3-rados-16.2.7-14.u6.fos23.aarch64.rpm libcephsqlite-16.2.7-14.u6.fos23.aarch64.rpm libcephsqlite-devel-16.2.7-14.u6.fos23.aarch64.rpm librbd1-16.2.7-14.u6.fos23.aarch64.rpm librbd-devel-16.2.7-14.u6.fos23.aarch64.rpm python3-rbd-16.2.7-14.u6.fos23.aarch64.rpm libcephfs2-16.2.7-14.u6.fos23.aarch64.rpm libcephfs-devel-16.2.7-14.u6.fos23.aarch64.rpm python3-cephfs-16.2.7-14.u6.fos23.aarch64.rpm python3-ceph-argparse-16.2.7-14.u6.fos23.aarch64.rpm python3-ceph-common-16.2.7-14.u6.fos23.aarch64.rpm ceph-test-16.2.7-14.u6.fos23.aarch64.rpm rados-objclass-devel-16.2.7-14.u6.fos23.aarch64.rpm FusionOS-SA-2023-2011 Critical FusionOS CVE-2023-20032:On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code. This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition. For a description of this vulnerability, see the ClamAV blog ["https://blog.clamav.net/"]. CVE-2023-20052:On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process. FusionOS clamav-0.103.8-1.fos23.x86_64.rpm clamav-devel-0.103.8-1.fos23.x86_64.rpm clamav-help-0.103.8-1.fos23.x86_64.rpm clamav-filesystem-0.103.8-1.fos23.noarch.rpm clamav-data-0.103.8-1.fos23.noarch.rpm clamav-update-0.103.8-1.fos23.x86_64.rpm clamd-0.103.8-1.fos23.x86_64.rpm clamav-milter-0.103.8-1.fos23.x86_64.rpm clamav-0.103.8-1.fos23.aarch64.rpm clamav-devel-0.103.8-1.fos23.aarch64.rpm clamav-help-0.103.8-1.fos23.aarch64.rpm clamav-update-0.103.8-1.fos23.aarch64.rpm clamd-0.103.8-1.fos23.aarch64.rpm clamav-milter-0.103.8-1.fos23.aarch64.rpm FusionOS-SA-2023-2012 Important FusionOS CVE-2022-23471:containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd's CRI implementation and the stream server is used for handling container IO. This bug has been fixed in containerd 1.6.12 and 1.5.16. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used and that only trusted users have permissions to execute commands in running containers. CVE-2023-25153:containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images. CVE-2023-25173:containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well. This bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `"USER $USERNAME"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT ["su", "-", "user"]` to allow `su` to properly set up supplementary groups. FusionOS containerd-1.6.9-1.u3.fos23.x86_64.rpm containerd-stress-1.6.9-1.u3.fos23.x86_64.rpm containerd-1.6.9-1.u3.fos23.aarch64.rpm containerd-stress-1.6.9-1.u3.fos23.aarch64.rpm FusionOS-SA-2023-2013 Moderate FusionOS CVE-2021-4122:It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium. FusionOS cryptsetup-2.4.1-4.u2.fos23.x86_64.rpm cryptsetup-devel-2.4.1-4.u2.fos23.x86_64.rpm veritysetup-2.4.1-4.u2.fos23.x86_64.rpm integritysetup-2.4.1-4.u2.fos23.x86_64.rpm cryptsetup-reencrypt-2.4.1-4.u2.fos23.x86_64.rpm cryptsetup-help-2.4.1-4.u2.fos23.noarch.rpm cryptsetup-2.4.1-4.u2.fos23.aarch64.rpm cryptsetup-devel-2.4.1-4.u2.fos23.aarch64.rpm veritysetup-2.4.1-4.u2.fos23.aarch64.rpm integritysetup-2.4.1-4.u2.fos23.aarch64.rpm cryptsetup-reencrypt-2.4.1-4.u2.fos23.aarch64.rpm FusionOS-SA-2023-2014 Important FusionOS CVE-2022-43551:A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded. CVE-2022-43552:A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path. CVE-2023-23914:A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on. CVE-2023-23915:A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS. CVE-2023-23916:An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors. FusionOS curl-7.79.1-14.u4.fos23.x86_64.rpm libcurl-7.79.1-14.u4.fos23.x86_64.rpm libcurl-devel-7.79.1-14.u4.fos23.x86_64.rpm curl-help-7.79.1-14.u4.fos23.noarch.rpm curl-7.79.1-14.u4.fos23.aarch64.rpm libcurl-7.79.1-14.u4.fos23.aarch64.rpm libcurl-devel-7.79.1-14.u4.fos23.aarch64.rpm FusionOS-SA-2023-2015 Important FusionOS CVE-2023-0401:A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider. PKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS implementation in OpenSSL does not call these functions however third party applications would be affected if they call these functions to verify signatures on untrusted data. FusionOS edk2-devel-202011-11.u1.fos23.x86_64.rpm python3-edk2-devel-202011-11.u1.fos23.noarch.rpm edk2-help-202011-11.u1.fos23.noarch.rpm edk2-ovmf-202011-11.u1.fos23.noarch.rpm edk2-devel-202011-11.u1.fos23.aarch64.rpm FusionOS-SA-2023-2016 Important FusionOS CVE-2022-48337:GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the "etags -u *" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input. CVE-2022-48338:An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may cause commands to be executed. FusionOS emacs-27.2-9.u1.fos23.x86_64.rpm emacs-devel-27.2-9.u1.fos23.x86_64.rpm emacs-lucid-27.2-9.u1.fos23.x86_64.rpm emacs-nox-27.2-9.u1.fos23.x86_64.rpm emacs-common-27.2-9.u1.fos23.x86_64.rpm emacs-terminal-27.2-9.u1.fos23.noarch.rpm emacs-filesystem-27.2-9.u1.fos23.noarch.rpm emacs-help-27.2-9.u1.fos23.noarch.rpm emacs-27.2-9.u1.fos23.aarch64.rpm emacs-devel-27.2-9.u1.fos23.aarch64.rpm emacs-lucid-27.2-9.u1.fos23.aarch64.rpm emacs-nox-27.2-9.u1.fos23.aarch64.rpm emacs-common-27.2-9.u1.fos23.aarch64.rpm FusionOS-SA-2023-2017 Important FusionOS CVE-2022-40899:An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server. FusionOS python3-future-0.18.2-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2018 Critical FusionOS CVE-2023-22490:Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253. A fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5 v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term workarounds are available. Avoid cloning repositories from untrusted sources with `--recurse-submodules`. Instead, consider cloning repositories without recursively cloning their submodules, and instead run `git submodule update` at each layer. Before doing so, inspect each new `.gitmodules` file to ensure that it does not contain suspicious module URLs. CVE-2023-23946:Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link. CVE-2022-41903:Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`. CVE-2022-23521:Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern. When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted `.gitattributes` file that may be part of the commit history. Git silently splits lines longer than 2KB when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index or both. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. There are no known workarounds for this issue. CVE-2022-41953:Git GUI is a convenient graphical tool that comes with Git for Windows. Its target audience is users who are uncomfortable with using Git on the command-line. Git GUI has a function to clone repositories. Immediately after the local clone is available, Git GUI will automatically post-process it, among other things running a spell checker called `aspell.exe` if it was found. Git GUI is implemented as a Tcl/Tk script. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable _always includes the current directory_. Therefore, malicious repositories can ship with an `aspell.exe` in their top-level directory which is executed by Git GUI without giving the user a chance to inspect it first, i.e. running untrusted code. This issue has been addressed in version 2.39.1. Users are advised to upgrade. Users unable to upgrade should avoid using Git GUI for cloning. If that is not a viable option, at least avoid cloning from untrusted sources. FusionOS git-2.33.0-9.u2.fos23.x86_64.rpm git-core-2.33.0-9.u2.fos23.x86_64.rpm git-daemon-2.33.0-9.u2.fos23.x86_64.rpm git-gui-2.33.0-9.u2.fos23.noarch.rpm gitk-2.33.0-9.u2.fos23.noarch.rpm git-web-2.33.0-9.u2.fos23.noarch.rpm git-svn-2.33.0-9.u2.fos23.noarch.rpm git-email-2.33.0-9.u2.fos23.noarch.rpm perl-Git-2.33.0-9.u2.fos23.noarch.rpm perl-Git-SVN-2.33.0-9.u2.fos23.noarch.rpm git-help-2.33.0-9.u2.fos23.noarch.rpm git-2.33.0-9.u2.fos23.aarch64.rpm git-core-2.33.0-9.u2.fos23.aarch64.rpm git-daemon-2.33.0-9.u2.fos23.aarch64.rpm FusionOS-SA-2023-2019 Critical FusionOS CVE-2023-0687:** DISPUTED ** A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE: The real existence of this vulnerability is still doubted at the moment. The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled. FusionOS glibc-2.34-113.u11.fos23.x86_64.rpm glibc-common-2.34-113.u11.fos23.x86_64.rpm glibc-all-langpacks-2.34-113.u11.fos23.x86_64.rpm glibc-locale-source-2.34-113.u11.fos23.x86_64.rpm glibc-locale-archive-2.34-113.u11.fos23.x86_64.rpm glibc-devel-2.34-113.u11.fos23.x86_64.rpm nscd-2.34-113.u11.fos23.x86_64.rpm nss_modules-2.34-113.u11.fos23.x86_64.rpm glibc-nss-devel-2.34-113.u11.fos23.x86_64.rpm libnsl-2.34-113.u11.fos23.x86_64.rpm glibc-debugutils-2.34-113.u11.fos23.x86_64.rpm glibc-help-2.34-113.u11.fos23.noarch.rpm glibc-compat-2.17-2.34-113.u11.fos23.x86_64.rpm glibc-2.34-113.u11.fos23.aarch64.rpm glibc-common-2.34-113.u11.fos23.aarch64.rpm glibc-all-langpacks-2.34-113.u11.fos23.aarch64.rpm glibc-locale-source-2.34-113.u11.fos23.aarch64.rpm glibc-locale-archive-2.34-113.u11.fos23.aarch64.rpm glibc-devel-2.34-113.u11.fos23.aarch64.rpm nscd-2.34-113.u11.fos23.aarch64.rpm nss_modules-2.34-113.u11.fos23.aarch64.rpm glibc-nss-devel-2.34-113.u11.fos23.aarch64.rpm libnsl-2.34-113.u11.fos23.aarch64.rpm glibc-debugutils-2.34-113.u11.fos23.aarch64.rpm glibc-compat-2.17-2.34-113.u11.fos23.aarch64.rpm FusionOS-SA-2023-2020 Important FusionOS CVE-2021-43618:GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms. FusionOS gmp-6.2.1-2.u1.fos23.x86_64.rpm gmp-devel-6.2.1-2.u1.fos23.x86_64.rpm gmp-c++-6.2.1-2.u1.fos23.x86_64.rpm gmp-6.2.1-2.u1.fos23.aarch64.rpm gmp-devel-6.2.1-2.u1.fos23.aarch64.rpm gmp-c++-6.2.1-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2021 Critical FusionOS CVE-2021-44716:net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests. CVE-2022-23772:Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption. CVE-2022-23773:cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags. CVE-2022-23806:Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element. CVE-2022-24921:regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression. CVE-2022-41717:An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection. FusionOS golang-1.19.4-1.u1.fos23.x86_64.rpm golang-help-1.19.4-1.u1.fos23.noarch.rpm golang-devel-1.19.4-1.u1.fos23.noarch.rpm golang-1.19.4-1.u1.fos23.aarch64.rpm FusionOS-SA-2023-2022 Critical FusionOS CVE-2023-0056:An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability. CVE-2023-25725:HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because the headers disappear before being parsed and processed, as if they had not been sent by the client. FusionOS haproxy-2.6.6-2.u1.fos23.x86_64.rpm haproxy-help-2.6.6-2.u1.fos23.noarch.rpm haproxy-2.6.6-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2023 Important FusionOS CVE-2023-25193:hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks. FusionOS harfbuzz-2.8.2-4.u1.fos23.x86_64.rpm harfbuzz-devel-2.8.2-4.u1.fos23.x86_64.rpm harfbuzz-help-2.8.2-4.u1.fos23.noarch.rpm harfbuzz-2.8.2-4.u1.fos23.aarch64.rpm harfbuzz-devel-2.8.2-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2024 Critical FusionOS CVE-2006-2001:Cross-site scripting (XSS) vulnerability in index.php in Scry Gallery 1.1 allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: this is a different vulnerability than the directory traversal vector. CVE-2022-36760:Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions. CVE-2022-37436:Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client. CVE-2023-25690:Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. For example, something like: RewriteEngine on RewriteRule "^/here/(.*)" "http://example.com:8080/elsewhere?$1"; [P] ProxyPassReverse /here/ http://example.com:8080/ Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server. CVE-2023-27522:HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client. FusionOS httpd-2.4.51-15.u5.fos23.x86_64.rpm httpd-devel-2.4.51-15.u5.fos23.x86_64.rpm httpd-help-2.4.51-15.u5.fos23.noarch.rpm httpd-filesystem-2.4.51-15.u5.fos23.noarch.rpm httpd-tools-2.4.51-15.u5.fos23.x86_64.rpm mod_ssl-2.4.51-15.u5.fos23.x86_64.rpm mod_md-2.4.51-15.u5.fos23.x86_64.rpm mod_proxy_html-2.4.51-15.u5.fos23.x86_64.rpm mod_ldap-2.4.51-15.u5.fos23.x86_64.rpm mod_session-2.4.51-15.u5.fos23.x86_64.rpm httpd-2.4.51-15.u5.fos23.aarch64.rpm httpd-devel-2.4.51-15.u5.fos23.aarch64.rpm httpd-tools-2.4.51-15.u5.fos23.aarch64.rpm mod_ssl-2.4.51-15.u5.fos23.aarch64.rpm mod_md-2.4.51-15.u5.fos23.aarch64.rpm mod_proxy_html-2.4.51-15.u5.fos23.aarch64.rpm mod_ldap-2.4.51-15.u5.fos23.aarch64.rpm mod_session-2.4.51-15.u5.fos23.aarch64.rpm FusionOS-SA-2023-2025 Important FusionOS CVE-2022-42004:In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization. FusionOS jackson-databind-2.9.8-9.u1.fos23.noarch.rpm jackson-databind-javadoc-2.9.8-9.u1.fos23.noarch.rpm FusionOS-SA-2023-2026 Critical FusionOS CVE-2014-125087:A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. The name of the patch is e6fddca201790abab4f2c274341c0bb8835c3e73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221480. FusionOS java-xmlbuilder-1.1-1.u1.fos23.noarch.rpm java-xmlbuilder-help-1.1-1.u1.fos23.noarch.rpm FusionOS-SA-2023-2027 Moderate FusionOS CVE-2021-28168:Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users. FusionOS jersey-2.29.1-1.u1.fos23.noarch.rpm jersey-test-framework-2.29.1-1.u1.fos23.noarch.rpm jersey-javadoc-2.29.1-1.u1.fos23.noarch.rpm FusionOS-SA-2023-2028 Important FusionOS CVE-2022-46663:In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal. FusionOS less-590-4.u1.fos23.x86_64.rpm less-help-590-4.u1.fos23.noarch.rpm less-590-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2029 Important FusionOS CVE-2022-44617:A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library. CVE-2022-46285:A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in the application linked to the library. CVE-2022-4883:A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable. FusionOS libXpm-3.5.13-4.u1.fos23.x86_64.rpm libXpm-devel-3.5.13-4.u1.fos23.x86_64.rpm libXpm-help-3.5.13-4.u1.fos23.noarch.rpm libXpm-3.5.13-4.u1.fos23.aarch64.rpm libXpm-devel-3.5.13-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2030 Moderate FusionOS CVE-2021-36976:libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block). FusionOS libarchive-3.5.2-6.u3.fos23.x86_64.rpm libarchive-devel-3.5.2-6.u3.fos23.x86_64.rpm libarchive-help-3.5.2-6.u3.fos23.noarch.rpm bsdtar-3.5.2-6.u3.fos23.x86_64.rpm bsdcpio-3.5.2-6.u3.fos23.x86_64.rpm bsdcat-3.5.2-6.u3.fos23.x86_64.rpm libarchive-3.5.2-6.u3.fos23.aarch64.rpm libarchive-devel-3.5.2-6.u3.fos23.aarch64.rpm bsdtar-3.5.2-6.u3.fos23.aarch64.rpm bsdcpio-3.5.2-6.u3.fos23.aarch64.rpm bsdcat-3.5.2-6.u3.fos23.aarch64.rpm FusionOS-SA-2023-2031 Critical FusionOS CVE-2022-47629:Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. FusionOS libksba-1.6.0-3.u1.fos23.x86_64.rpm libksba-devel-1.6.0-3.u1.fos23.x86_64.rpm libksba-help-1.6.0-3.u1.fos23.noarch.rpm libksba-1.6.0-3.u1.fos23.aarch64.rpm libksba-devel-1.6.0-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2032 Moderate FusionOS CVE-2023-27371:GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function. FusionOS libmicrohttpd-0.9.75-4.u1.fos23.x86_64.rpm libmicrohttpd-devel-0.9.75-4.u1.fos23.x86_64.rpm libmicrohttpd-help-0.9.75-4.u1.fos23.noarch.rpm libmicrohttpd-0.9.75-4.u1.fos23.aarch64.rpm libmicrohttpd-devel-0.9.75-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2033 Moderate FusionOS CVE-2023-23009:Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length. FusionOS libreswan-4.5-3.u1.fos23.x86_64.rpm libreswan-help-4.5-3.u1.fos23.x86_64.rpm libreswan-4.5-3.u1.fos23.aarch64.rpm libreswan-help-4.5-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2034 Important FusionOS CVE-2022-48281:processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of size 307203") via a crafted TIFF image. CVE-2023-0795:LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3488, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. CVE-2023-0796:LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3592, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. CVE-2023-0797:LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6921, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. CVE-2023-0798:LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3400, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. CVE-2023-0799:LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3701, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. CVE-2023-0800:LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. CVE-2023-0801:LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6778, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. CVE-2023-0802:LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3724, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. CVE-2023-0803:LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3516, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. CVE-2023-0804:LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. FusionOS libtiff-4.3.0-24.u2.fos23.x86_64.rpm libtiff-devel-4.3.0-24.u2.fos23.x86_64.rpm libtiff-static-4.3.0-24.u2.fos23.x86_64.rpm libtiff-tools-4.3.0-24.u2.fos23.x86_64.rpm libtiff-help-4.3.0-24.u2.fos23.noarch.rpm libtiff-4.3.0-24.u2.fos23.aarch64.rpm libtiff-devel-4.3.0-24.u2.fos23.aarch64.rpm libtiff-static-4.3.0-24.u2.fos23.aarch64.rpm libtiff-tools-4.3.0-24.u2.fos23.aarch64.rpm FusionOS-SA-2023-2035 Low FusionOS CVE-2022-47952:lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because "Failed to open" often indicates that a file does not exist, whereas "does not refer to a network namespace path" often indicates that a file exists. NOTE: this is different from CVE-2018-6556 because the CVE-2018-6556 fix design was based on the premise that "we will report back to the user that the open() failed but the user has no way of knowing why it failed"; however, in many realistic cases, there are no plausible reasons for failing except that the file does not exist. FusionOS lxc-4.0.3-2022102413.u4.fos23.x86_64.rpm lxc-libs-4.0.3-2022102413.u4.fos23.x86_64.rpm lxc-devel-4.0.3-2022102413.u4.fos23.x86_64.rpm lxc-help-4.0.3-2022102413.u4.fos23.noarch.rpm lxc-4.0.3-2022102413.u4.fos23.aarch64.rpm lxc-libs-4.0.3-2022102413.u4.fos23.aarch64.rpm lxc-devel-4.0.3-2022102413.u4.fos23.aarch64.rpm FusionOS-SA-2023-2036 Moderate FusionOS CVE-2022-44792:handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker (who has write access) to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service. CVE-2022-44793:handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service. FusionOS net-snmp-5.9.1-5.u1.fos23.x86_64.rpm net-snmp-libs-5.9.1-5.u1.fos23.x86_64.rpm net-snmp-devel-5.9.1-5.u1.fos23.x86_64.rpm net-snmp-perl-5.9.1-5.u1.fos23.x86_64.rpm net-snmp-gui-5.9.1-5.u1.fos23.x86_64.rpm python3-net-snmp-5.9.1-5.u1.fos23.x86_64.rpm net-snmp-help-5.9.1-5.u1.fos23.noarch.rpm net-snmp-5.9.1-5.u1.fos23.aarch64.rpm net-snmp-libs-5.9.1-5.u1.fos23.aarch64.rpm net-snmp-devel-5.9.1-5.u1.fos23.aarch64.rpm net-snmp-perl-5.9.1-5.u1.fos23.aarch64.rpm net-snmp-gui-5.9.1-5.u1.fos23.aarch64.rpm python3-net-snmp-5.9.1-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2037 Important FusionOS CVE-2022-4304:A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. CVE-2022-4450:The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue. CVE-2023-0215:The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7. Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream. The OpenSSL cms and smime command line applications are similarly affected. CVE-2023-0286:There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. FusionOS nodejs-12.22.11-4.u1.fos23.x86_64.rpm nodejs-devel-12.22.11-4.u1.fos23.x86_64.rpm nodejs-libs-12.22.11-4.u1.fos23.x86_64.rpm nodejs-full-i18n-12.22.11-4.u1.fos23.x86_64.rpm v8-devel-7.8.279.23-1.12.22.11.4.u1.fos23.x86_64.rpm npm-6.14.16-1.12.22.11.4.u1.fos23.x86_64.rpm nodejs-docs-12.22.11-4.u1.fos23.noarch.rpm nodejs-12.22.11-4.u1.fos23.aarch64.rpm nodejs-devel-12.22.11-4.u1.fos23.aarch64.rpm nodejs-libs-12.22.11-4.u1.fos23.aarch64.rpm nodejs-full-i18n-12.22.11-4.u1.fos23.aarch64.rpm v8-devel-7.8.279.23-1.12.22.11.4.u1.fos23.aarch64.rpm npm-6.14.16-1.12.22.11.4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2038 Critical FusionOS CVE-2023-25136:OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible." FusionOS openssh-8.8p1-19.u6.fos23.x86_64.rpm openssh-clients-8.8p1-19.u6.fos23.x86_64.rpm openssh-server-8.8p1-19.u6.fos23.x86_64.rpm openssh-keycat-8.8p1-19.u6.fos23.x86_64.rpm openssh-askpass-8.8p1-19.u6.fos23.x86_64.rpm pam_ssh_agent_auth-0.10.4-4.19.u6.fos23.x86_64.rpm openssh-help-8.8p1-19.u6.fos23.noarch.rpm openssh-8.8p1-19.u6.fos23.aarch64.rpm openssh-clients-8.8p1-19.u6.fos23.aarch64.rpm openssh-server-8.8p1-19.u6.fos23.aarch64.rpm openssh-keycat-8.8p1-19.u6.fos23.aarch64.rpm openssh-askpass-8.8p1-19.u6.fos23.aarch64.rpm pam_ssh_agent_auth-0.10.4-4.19.u6.fos23.aarch64.rpm FusionOS-SA-2023-2039 Important FusionOS CVE-2022-4304:A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. CVE-2022-4450:The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue. CVE-2023-0215:The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7. Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream. The OpenSSL cms and smime command line applications are similarly affected. CVE-2023-0286:There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. FusionOS openssl-1.1.1m-18.u3.fos23.x86_64.rpm openssl-libs-1.1.1m-18.u3.fos23.x86_64.rpm openssl-perl-1.1.1m-18.u3.fos23.x86_64.rpm openssl-devel-1.1.1m-18.u3.fos23.x86_64.rpm openssl-help-1.1.1m-18.u3.fos23.noarch.rpm openssl-1.1.1m-18.u3.fos23.aarch64.rpm openssl-libs-1.1.1m-18.u3.fos23.aarch64.rpm openssl-perl-1.1.1m-18.u3.fos23.aarch64.rpm openssl-devel-1.1.1m-18.u3.fos23.aarch64.rpm FusionOS-SA-2023-2040 Critical FusionOS CVE-2022-4338:An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch. FusionOS openvswitch-2.12.4-2.u1.fos23.x86_64.rpm openvswitch-devel-2.12.4-2.u1.fos23.x86_64.rpm openvswitch-help-2.12.4-2.u1.fos23.x86_64.rpm python3-openvswitch-2.12.4-2.u1.fos23.noarch.rpm openvswitch-2.12.4-2.u1.fos23.aarch64.rpm openvswitch-devel-2.12.4-2.u1.fos23.aarch64.rpm openvswitch-help-2.12.4-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2041 Important FusionOS CVE-2022-47021:A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause denial of service or other unspecified impacts. FusionOS opusfile-0.11-5.u1.fos23.x86_64.rpm opusfile-devel-0.11-5.u1.fos23.x86_64.rpm opusfile-0.11-5.u1.fos23.aarch64.rpm opusfile-devel-0.11-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2042 Moderate FusionOS CVE-2022-3560:A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group. However, the script doesn't check for symbolic links. This could allow an attacker to gain access to privileged files and directories via a path traversal attack. FusionOS pesign-115-4.u1.fos23.x86_64.rpm pesign-help-115-4.u1.fos23.x86_64.rpm pesign-115-4.u1.fos23.aarch64.rpm pesign-help-115-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2043 Moderate FusionOS CVE-2023-24056:In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes. FusionOS pkgconf-1.8.0-3.u1.fos23.x86_64.rpm pkgconf-devel-1.8.0-3.u1.fos23.x86_64.rpm pkgconf-help-1.8.0-3.u1.fos23.noarch.rpm pkgconf-1.8.0-3.u1.fos23.aarch64.rpm pkgconf-devel-1.8.0-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2044 Moderate FusionOS CVE-2022-37337:A command execution vulnerability exists in the access control functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. FusionOS poppler-0.90.0-4.u1.fos23.x86_64.rpm poppler-devel-0.90.0-4.u1.fos23.x86_64.rpm poppler-glib-0.90.0-4.u1.fos23.x86_64.rpm poppler-glib-devel-0.90.0-4.u1.fos23.x86_64.rpm poppler-glib-doc-0.90.0-4.u1.fos23.noarch.rpm poppler-qt5-0.90.0-4.u1.fos23.x86_64.rpm poppler-qt5-devel-0.90.0-4.u1.fos23.x86_64.rpm poppler-cpp-0.90.0-4.u1.fos23.x86_64.rpm poppler-cpp-devel-0.90.0-4.u1.fos23.x86_64.rpm poppler-utils-0.90.0-4.u1.fos23.x86_64.rpm poppler-help-0.90.0-4.u1.fos23.noarch.rpm poppler-0.90.0-4.u1.fos23.aarch64.rpm poppler-devel-0.90.0-4.u1.fos23.aarch64.rpm poppler-glib-0.90.0-4.u1.fos23.aarch64.rpm poppler-glib-devel-0.90.0-4.u1.fos23.aarch64.rpm poppler-qt5-0.90.0-4.u1.fos23.aarch64.rpm poppler-qt5-devel-0.90.0-4.u1.fos23.aarch64.rpm poppler-cpp-0.90.0-4.u1.fos23.aarch64.rpm poppler-cpp-devel-0.90.0-4.u1.fos23.aarch64.rpm poppler-utils-0.90.0-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2045 Important FusionOS CVE-2022-4603:** DISPUTED ** A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario. FusionOS ppp-2.4.9-5.u3.fos23.x86_64.rpm ppp-devel-2.4.9-5.u3.fos23.x86_64.rpm ppp-help-2.4.9-5.u3.fos23.noarch.rpm ppp-2.4.9-5.u3.fos23.aarch64.rpm ppp-devel-2.4.9-5.u3.fos23.aarch64.rpm FusionOS-SA-2023-2046 Moderate FusionOS CVE-2023-23931:cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8. FusionOS python3-cryptography-36.0.1-2.u1.fos23.x86_64.rpm python-cryptography-help-36.0.1-2.u1.fos23.noarch.rpm python3-cryptography-36.0.1-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2047 Important FusionOS CVE-2022-40898:An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. FusionOS python3-wheel-0.37.0-2.u1.fos23.noarch.rpm python-wheel-wheel-0.37.0-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2048 Important FusionOS CVE-2021-33621:The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object. FusionOS ruby-3.0.3-128.u1.fos23.x86_64.rpm ruby-devel-3.0.3-128.u1.fos23.x86_64.rpm rubygems-3.2.32-128.u1.fos23.noarch.rpm rubygems-devel-3.2.32-128.u1.fos23.noarch.rpm rubygem-rake-13.0.3-128.u1.fos23.noarch.rpm rubygem-rbs-1.4.0-128.u1.fos23.noarch.rpm ruby-irb-3.0.3-128.u1.fos23.noarch.rpm rubygem-rdoc-6.3.3-128.u1.fos23.noarch.rpm ruby-help-3.0.3-128.u1.fos23.noarch.rpm rubygem-bigdecimal-3.0.0-128.u1.fos23.x86_64.rpm rubygem-did_you_mean-1.5.0-128.u1.fos23.noarch.rpm rubygem-io-console-0.5.7-128.u1.fos23.x86_64.rpm rubygem-json-2.5.1-128.u1.fos23.x86_64.rpm rubygem-minitest-5.14.2-128.u1.fos23.noarch.rpm rubygem-openssl-2.2.1-128.u1.fos23.x86_64.rpm rubygem-power_assert-1.2.0-128.u1.fos23.noarch.rpm rubygem-psych-3.3.2-128.u1.fos23.x86_64.rpm rubygem-test-unit-3.3.7-128.u1.fos23.noarch.rpm rubygem-rexml-3.2.5-128.u1.fos23.noarch.rpm rubygem-rss-0.2.9-128.u1.fos23.noarch.rpm rubygem-typeprof-0.15.2-128.u1.fos23.noarch.rpm ruby-3.0.3-128.u1.fos23.aarch64.rpm ruby-devel-3.0.3-128.u1.fos23.aarch64.rpm rubygem-bigdecimal-3.0.0-128.u1.fos23.aarch64.rpm rubygem-io-console-0.5.7-128.u1.fos23.aarch64.rpm rubygem-json-2.5.1-128.u1.fos23.aarch64.rpm rubygem-openssl-2.2.1-128.u1.fos23.aarch64.rpm rubygem-psych-3.3.2-128.u1.fos23.aarch64.rpm FusionOS-SA-2023-2049 Important FusionOS CVE-2022-44566:A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service. CVE-2023-22794:A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment. FusionOS rubygem-activerecord-6.1.4.1-2.u1.fos23.noarch.rpm rubygem-activerecord-doc-6.1.4.1-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2050 Important FusionOS CVE-2023-22796:A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability. FusionOS rubygem-activesupport-6.1.4.1-5.u2.fos23.noarch.rpm rubygem-activesupport-doc-6.1.4.1-5.u2.fos23.noarch.rpm FusionOS-SA-2023-2051 Important FusionOS CVE-2023-22799:A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately. FusionOS rubygem-globalid-0.4.2-4.u1.fos23.noarch.rpm rubygem-globalid-doc-0.4.2-4.u1.fos23.noarch.rpm FusionOS-SA-2023-2052 Important FusionOS CVE-2023-0286:There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. FusionOS shim-15.6-9.u4.fos23.x86_64.rpm shim-15.6-9.u4.fos23.aarch64.rpm FusionOS-SA-2023-2053 Important FusionOS CVE-2022-25857:The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections. CVE-2022-38749:Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. CVE-2022-38750:Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. CVE-2022-38751:Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. CVE-2022-38752:Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow. CVE-2022-41854:Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack. FusionOS snakeyaml-1.32-1.u1.fos23.noarch.rpm snakeyaml-javadoc-1.32-1.u1.fos23.noarch.rpm FusionOS-SA-2023-2054 Important FusionOS CVE-2023-22809:In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value. CVE-2023-27320:This vulnerability has been modified since it was last analyzed by the NVD. It is awaiting reanalysis which may result in further changes to the information provided. FusionOS sudo-1.9.8p2-10.u3.fos23.x86_64.rpm sudo-devel-1.9.8p2-10.u3.fos23.x86_64.rpm sudo-help-1.9.8p2-10.u3.fos23.noarch.rpm sudo-1.9.8p2-10.u3.fos23.aarch64.rpm sudo-devel-1.9.8p2-10.u3.fos23.aarch64.rpm FusionOS-SA-2023-2055 Moderate FusionOS CVE-2022-4415:A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting. FusionOS systemd-249-46.u7.fos23.x86_64.rpm systemd-devel-249-46.u7.fos23.x86_64.rpm systemd-libs-249-46.u7.fos23.x86_64.rpm systemd-udev-249-46.u7.fos23.x86_64.rpm systemd-container-249-46.u7.fos23.x86_64.rpm systemd-resolved-249-46.u7.fos23.x86_64.rpm systemd-nspawn-249-46.u7.fos23.x86_64.rpm systemd-networkd-249-46.u7.fos23.x86_64.rpm systemd-timesyncd-249-46.u7.fos23.x86_64.rpm systemd-pam-249-46.u7.fos23.x86_64.rpm systemd-help-249-46.u7.fos23.noarch.rpm systemd-249-46.u7.fos23.aarch64.rpm systemd-devel-249-46.u7.fos23.aarch64.rpm systemd-libs-249-46.u7.fos23.aarch64.rpm systemd-udev-249-46.u7.fos23.aarch64.rpm systemd-container-249-46.u7.fos23.aarch64.rpm systemd-resolved-249-46.u7.fos23.aarch64.rpm systemd-nspawn-249-46.u7.fos23.aarch64.rpm systemd-networkd-249-46.u7.fos23.aarch64.rpm systemd-timesyncd-249-46.u7.fos23.aarch64.rpm systemd-pam-249-46.u7.fos23.aarch64.rpm FusionOS-SA-2023-2056 Important FusionOS CVE-2022-48303:GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters. FusionOS tar-1.34-4.u1.fos23.x86_64.rpm tar-help-1.34-4.u1.fos23.noarch.rpm tar-1.34-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2057 Important FusionOS CVE-2022-47016:** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. FusionOS tmux-3.2a-3.u1.fos23.x86_64.rpm tmux-help-3.2a-3.u1.fos23.noarch.rpm tmux-3.2a-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2058 Important FusionOS CVE-2022-42252:If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header. CVE-2021-43980:The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client. FusionOS tomcat-9.0.10-29.u4.fos23.noarch.rpm tomcat-jsvc-9.0.10-29.u4.fos23.noarch.rpm tomcat-help-9.0.10-29.u4.fos23.noarch.rpm FusionOS-SA-2023-2059 Moderate FusionOS CVE-2023-22745:tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In affected versions `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access to the TPM system. Usually TPM access requires administrative privilege. FusionOS tpm2-tss-3.1.0-3.u1.fos23.x86_64.rpm tpm2-tss-devel-3.1.0-3.u1.fos23.x86_64.rpm tpm2-tss-help-3.1.0-3.u1.fos23.noarch.rpm tpm2-tss-3.1.0-3.u1.fos23.aarch64.rpm tpm2-tss-devel-3.1.0-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2060 Important FusionOS CVE-2023-0051:Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. CVE-2023-0054:Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. CVE-2023-0049:Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. CVE-2023-0288:Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. CVE-2022-47024:A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thru 9.0.0339 allows attackers to cause denial of service or other unspecified impacts. CVE-2023-0433:Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225. CVE-2023-1170:Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376. CVE-2023-1175:Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378. FusionOS vim-common-9.0-11.u4.fos23.x86_64.rpm vim-minimal-9.0-11.u4.fos23.x86_64.rpm vim-enhanced-9.0-11.u4.fos23.x86_64.rpm vim-filesystem-9.0-11.u4.fos23.noarch.rpm vim-X11-9.0-11.u4.fos23.x86_64.rpm vim-common-9.0-11.u4.fos23.aarch64.rpm vim-minimal-9.0-11.u4.fos23.aarch64.rpm vim-enhanced-9.0-11.u4.fos23.aarch64.rpm vim-X11-9.0-11.u4.fos23.aarch64.rpm FusionOS-SA-2023-2061 Important FusionOS CVE-2022-3724:Crash in the USB HID protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file on Windows CVE-2023-0416:GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2023-0411:Excessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2023-0413:Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2023-0415:iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2023-0417:Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2022-4344:Memory exhaustion in the Kafka protocol dissector in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file CVE-2022-4345:Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file CVE-2023-0412:TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2023-1161:ISO 15765 and ISO 10681 dissector crash in Wireshark 4.0.0 to 4.0.3 and 3.6.0 to 3.6.11 allows denial of service via packet injection or crafted capture file FusionOS wireshark-3.6.11-1.u1.fos23.x86_64.rpm wireshark-devel-3.6.11-1.u1.fos23.x86_64.rpm wireshark-help-3.6.11-1.u1.fos23.x86_64.rpm wireshark-3.6.11-1.u1.fos23.aarch64.rpm wireshark-devel-3.6.11-1.u1.fos23.aarch64.rpm wireshark-help-3.6.11-1.u1.fos23.aarch64.rpm FusionOS-SA-2023-2062 Important FusionOS CVE-2023-0494:A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions. FusionOS xorg-x11-server-1.20.11-16.u3.fos23.x86_64.rpm xorg-x11-server-common-1.20.11-16.u3.fos23.x86_64.rpm xorg-x11-server-Xnest-1.20.11-16.u3.fos23.x86_64.rpm xorg-x11-server-Xdmx-1.20.11-16.u3.fos23.x86_64.rpm xorg-x11-server-Xvfb-1.20.11-16.u3.fos23.x86_64.rpm xorg-x11-server-Xephyr-1.20.11-16.u3.fos23.x86_64.rpm xorg-x11-server-devel-1.20.11-16.u3.fos23.x86_64.rpm xorg-x11-server-help-1.20.11-16.u3.fos23.noarch.rpm xorg-x11-server-source-1.20.11-16.u3.fos23.noarch.rpm xorg-x11-server-1.20.11-16.u3.fos23.aarch64.rpm xorg-x11-server-common-1.20.11-16.u3.fos23.aarch64.rpm xorg-x11-server-Xnest-1.20.11-16.u3.fos23.aarch64.rpm xorg-x11-server-Xdmx-1.20.11-16.u3.fos23.aarch64.rpm xorg-x11-server-Xvfb-1.20.11-16.u3.fos23.aarch64.rpm xorg-x11-server-Xephyr-1.20.11-16.u3.fos23.aarch64.rpm xorg-x11-server-devel-1.20.11-16.u3.fos23.aarch64.rpm FusionOS-SA-2023-2063 Important FusionOS CVE-2022-41966:XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable. FusionOS xstream-1.4.18-3.u2.fos23.noarch.rpm xstream-javadoc-1.4.18-3.u2.fos23.noarch.rpm xstream-hibernate-1.4.18-3.u2.fos23.noarch.rpm xstream-benchmark-1.4.18-3.u2.fos23.noarch.rpm xstream-parent-1.4.18-3.u2.fos23.noarch.rpm FusionOS-SA-2023-2064 Moderate FusionOS CVE-2023-1289:A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G. CVE-2023-1906:A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service. FusionOS ImageMagick-7.1.1.8-1.u1.fos23.x86_64.rpm ImageMagick-devel-7.1.1.8-1.u1.fos23.x86_64.rpm ImageMagick-help-7.1.1.8-1.u1.fos23.x86_64.rpm ImageMagick-perl-7.1.1.8-1.u1.fos23.x86_64.rpm ImageMagick-c++-7.1.1.8-1.u1.fos23.x86_64.rpm ImageMagick-c++-devel-7.1.1.8-1.u1.fos23.x86_64.rpm ImageMagick-7.1.1.8-1.u1.fos23.aarch64.rpm ImageMagick-devel-7.1.1.8-1.u1.fos23.aarch64.rpm ImageMagick-help-7.1.1.8-1.u1.fos23.aarch64.rpm ImageMagick-perl-7.1.1.8-1.u1.fos23.aarch64.rpm ImageMagick-c++-7.1.1.8-1.u1.fos23.aarch64.rpm ImageMagick-c++-devel-7.1.1.8-1.u1.fos23.aarch64.rpm FusionOS-SA-2023-2065 Moderate FusionOS CVE-2023-1981:It was discovered that the avahi deamon can be locally crashed by a dbus call made by an unprivileged user, causing a denial of service. FusionOS avahi-0.8-15.u1.fos23.x86_64.rpm avahi-tools-0.8-15.u1.fos23.x86_64.rpm avahi-ui-0.8-15.u1.fos23.x86_64.rpm avahi-autoipd-0.8-15.u1.fos23.x86_64.rpm avahi-dnsconfd-0.8-15.u1.fos23.x86_64.rpm avahi-compat-howl-0.8-15.u1.fos23.x86_64.rpm avahi-compat-howl-devel-0.8-15.u1.fos23.x86_64.rpm avahi-compat-libdns_sd-0.8-15.u1.fos23.x86_64.rpm avahi-compat-libdns_sd-devel-0.8-15.u1.fos23.x86_64.rpm avahi-devel-0.8-15.u1.fos23.x86_64.rpm avahi-glib-0.8-15.u1.fos23.x86_64.rpm avahi-glib-devel-0.8-15.u1.fos23.x86_64.rpm avahi-gobject-0.8-15.u1.fos23.x86_64.rpm avahi-gobject-devel-0.8-15.u1.fos23.x86_64.rpm avahi-ui-gtk3-0.8-15.u1.fos23.x86_64.rpm avahi-ui-devel-0.8-15.u1.fos23.x86_64.rpm avahi-libs-0.8-15.u1.fos23.x86_64.rpm avahi-help-0.8-15.u1.fos23.noarch.rpm avahi-0.8-15.u1.fos23.aarch64.rpm avahi-tools-0.8-15.u1.fos23.aarch64.rpm avahi-ui-0.8-15.u1.fos23.aarch64.rpm avahi-autoipd-0.8-15.u1.fos23.aarch64.rpm avahi-dnsconfd-0.8-15.u1.fos23.aarch64.rpm avahi-compat-howl-0.8-15.u1.fos23.aarch64.rpm avahi-compat-howl-devel-0.8-15.u1.fos23.aarch64.rpm avahi-compat-libdns_sd-0.8-15.u1.fos23.aarch64.rpm avahi-compat-libdns_sd-devel-0.8-15.u1.fos23.aarch64.rpm avahi-devel-0.8-15.u1.fos23.aarch64.rpm avahi-glib-0.8-15.u1.fos23.aarch64.rpm avahi-glib-devel-0.8-15.u1.fos23.aarch64.rpm avahi-gobject-0.8-15.u1.fos23.aarch64.rpm avahi-gobject-devel-0.8-15.u1.fos23.aarch64.rpm avahi-ui-gtk3-0.8-15.u1.fos23.aarch64.rpm avahi-ui-devel-0.8-15.u1.fos23.aarch64.rpm avahi-libs-0.8-15.u1.fos23.aarch64.rpm FusionOS-SA-2023-2066 Important FusionOS CVE-2023-27349:This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. FusionOS bluez-5.54-17.u2.fos23.x86_64.rpm bluez-libs-5.54-17.u2.fos23.x86_64.rpm bluez-devel-5.54-17.u2.fos23.x86_64.rpm bluez-help-5.54-17.u2.fos23.noarch.rpm bluez-cups-5.54-17.u2.fos23.x86_64.rpm bluez-5.54-17.u2.fos23.aarch64.rpm bluez-libs-5.54-17.u2.fos23.aarch64.rpm bluez-devel-5.54-17.u2.fos23.aarch64.rpm bluez-cups-5.54-17.u2.fos23.aarch64.rpm FusionOS-SA-2023-2067 Critical FusionOS CVE-2023-27533:curl supports communicating using the TELNET protocol and as a part of this it offers users to pass on user name and "telnet options" for the servernegotiation. Due to lack of proper input scrubbing and without it being the documented functionality, curl would pass on user name and telnet options to the server as provided. This could allow users to pass in carefully crafted content that pass on content or do option negotiation without the application intending to do so. In particular if an application for example allows users to provide the data or parts of the data. CVE-2023-27534:to-become RFC draft](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-scp-sftp-ssh-uri-04) that was to dictate how SFTP URLs work. Due to a bug, the handling of the tilde in SFTP path did however not only replace it when it is used stand-alone as the first path element but also wrongly when used as a mere prefix in the first element. Using a path like `/~2/foo` when accessing a server using the user `dan` (with home directory `/home/dan`) would then quite suprisingly access the file `/home/dan2/foo`. This can be taken advantage of to circumvent filtering or worse. CVE-2023-27535:libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several FTP settings were left out from the configuration match checks, making them match too easily. The settings in questions are `CURLOPT_FTP_ACCOUNT`, `CURLOPT_FTP_ALTERNATIVE_TO_USER`, `CURLOPT_FTP_SSL_CCC` and `CURLOPT_USE_SSL` level. CVE-2023-27536:libcurl would reuse a previously created connection even when the GSS delegation (`CURLOPT_GSSAPI_DELEGATION`) option had been changed that could have changed the user's permissions in a second transfer. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, this GSS delegation setting was left out from the configuration match checks, making them match too easily, affecting krb5/kerberos/negotiate/GSSAPI transfers. CVE-2023-27538:libcurl would reuse a previously created connection even when an SSH related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, two SSH settings were left out from the configuration match checks, making them match too easily. FusionOS curl-7.79.1-15.u5.fos23.x86_64.rpm libcurl-7.79.1-15.u5.fos23.x86_64.rpm libcurl-devel-7.79.1-15.u5.fos23.x86_64.rpm curl-help-7.79.1-15.u5.fos23.noarch.rpm curl-7.79.1-15.u5.fos23.aarch64.rpm libcurl-7.79.1-15.u5.fos23.aarch64.rpm libcurl-devel-7.79.1-15.u5.fos23.aarch64.rpm FusionOS-SA-2023-2068 Important FusionOS CVE-2023-30630:Dmidecode reports information about your system's hardware as described in your system BIOS according to the SMBIOS/DMI standard (see a sample output). This information typically includes system manufacturer, model name, serial number, BIOS version, asset tag as well as a lot of other details of varying level of interest and reliability depending on the manufacturer. This will often include usage status for the CPU sockets, expansion slots (e.g. AGP, PCI, ISA) and memory module slots, and the list of I/O ports (e.g. serial, parallel, USB).DMI data can be used to enable or disable specific portions of kernel code depending on the specific hardware. Thus, one use of dmidecode is for kernel developers to detect system "signatures" and add them to the kernel source code when needed. FusionOS dmidecode-3.4-3.u1.fos23.x86_64.rpm dmidecode-3.4-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2069 Important FusionOS CVE-2023-28450:An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. FusionOS dnsmasq-2.86-5.u2.fos23.x86_64.rpm dnsmasq-help-2.86-5.u2.fos23.x86_64.rpm dnsmasq-2.86-5.u2.fos23.aarch64.rpm dnsmasq-help-2.86-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2070 Important FusionOS CVE-2023-28617:Emacs is the extensible, customizable, self-documenting real-time display editor. At its core is an interpreter for Emacs Lisp, a dialect of the Lisp programming language with extensions to support text editing. And it is an entire ecosystem of functionality beyond text editing, including a project planner, mail and news reader, debugger interface, calendar, and more. FusionOS emacs-27.2-10.u2.fos23.x86_64.rpm emacs-devel-27.2-10.u2.fos23.x86_64.rpm emacs-lucid-27.2-10.u2.fos23.x86_64.rpm emacs-nox-27.2-10.u2.fos23.x86_64.rpm emacs-common-27.2-10.u2.fos23.x86_64.rpm emacs-terminal-27.2-10.u2.fos23.noarch.rpm emacs-filesystem-27.2-10.u2.fos23.noarch.rpm emacs-help-27.2-10.u2.fos23.noarch.rpm emacs-27.2-10.u2.fos23.aarch64.rpm emacs-devel-27.2-10.u2.fos23.aarch64.rpm emacs-lucid-27.2-10.u2.fos23.aarch64.rpm emacs-nox-27.2-10.u2.fos23.aarch64.rpm emacs-common-27.2-10.u2.fos23.aarch64.rpm FusionOS-SA-2023-2071 Important FusionOS CVE-2023-2004:FreeType is written in C, designed to be small,efficient, highly customizable, and portable while capable of producing high-quality output (glyph images) of most vector and bitmap font formats FusionOS freetype-2.12.1-2.u1.fos23.x86_64.rpm freetype-demos-2.12.1-2.u1.fos23.x86_64.rpm freetype-devel-2.12.1-2.u1.fos23.x86_64.rpm freetype-help-2.12.1-2.u1.fos23.noarch.rpm freetype-2.12.1-2.u1.fos23.aarch64.rpm freetype-demos-2.12.1-2.u1.fos23.aarch64.rpm freetype-devel-2.12.1-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2072 Moderate FusionOS CVE-2023-24593:GLib is a bundle of three (formerly five) low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since. CVE-2023-25180:GLib is a bundle of three (formerly five) low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since. FusionOS glib2-2.72.2-9.u4.fos23.x86_64.rpm glib2-devel-2.72.2-9.u4.fos23.x86_64.rpm glib2-static-2.72.2-9.u4.fos23.x86_64.rpm glib2-tests-2.72.2-9.u4.fos23.x86_64.rpm glib2-help-2.72.2-9.u4.fos23.noarch.rpm glib2-2.72.2-9.u4.fos23.aarch64.rpm glib2-devel-2.72.2-9.u4.fos23.aarch64.rpm glib2-static-2.72.2-9.u4.fos23.aarch64.rpm glib2-tests-2.72.2-9.u4.fos23.aarch64.rpm FusionOS-SA-2023-2073 Important FusionOS CVE-2023-26253:In Gluster GlusterFS 11.0, there is an xlators/mount/fuse/src/fuse-bridge.c notify stack-based buffer over-read. FusionOS glusterfs-10.0-8.u1.fos23.x86_64.rpm glusterfs-cli-10.0-8.u1.fos23.x86_64.rpm glusterfs-cloudsync-plugins-10.0-8.u1.fos23.x86_64.rpm glusterfs-extra-xlators-10.0-8.u1.fos23.x86_64.rpm glusterfs-fuse-10.0-8.u1.fos23.x86_64.rpm glusterfs-geo-replication-10.0-8.u1.fos23.x86_64.rpm libglusterfs0-10.0-8.u1.fos23.x86_64.rpm libglusterfs-devel-10.0-8.u1.fos23.x86_64.rpm libgfapi0-10.0-8.u1.fos23.x86_64.rpm libgfapi-devel-10.0-8.u1.fos23.x86_64.rpm libgfchangelog0-10.0-8.u1.fos23.x86_64.rpm libgfchangelog-devel-10.0-8.u1.fos23.x86_64.rpm libgfrpc0-10.0-8.u1.fos23.x86_64.rpm libgfrpc-devel-10.0-8.u1.fos23.x86_64.rpm libgfxdr0-10.0-8.u1.fos23.x86_64.rpm libgfxdr-devel-10.0-8.u1.fos23.x86_64.rpm libglusterd0-10.0-8.u1.fos23.x86_64.rpm python3-gluster-10.0-8.u1.fos23.x86_64.rpm glusterfs-resource-agents-10.0-8.u1.fos23.noarch.rpm glusterfs-server-10.0-8.u1.fos23.x86_64.rpm glusterfs-thin-arbiter-10.0-8.u1.fos23.x86_64.rpm glusterfs-client-xlators-10.0-8.u1.fos23.x86_64.rpm glusterfs-events-10.0-8.u1.fos23.x86_64.rpm glusterfs-10.0-8.u1.fos23.aarch64.rpm glusterfs-cli-10.0-8.u1.fos23.aarch64.rpm glusterfs-cloudsync-plugins-10.0-8.u1.fos23.aarch64.rpm glusterfs-extra-xlators-10.0-8.u1.fos23.aarch64.rpm glusterfs-fuse-10.0-8.u1.fos23.aarch64.rpm glusterfs-geo-replication-10.0-8.u1.fos23.aarch64.rpm libglusterfs0-10.0-8.u1.fos23.aarch64.rpm libglusterfs-devel-10.0-8.u1.fos23.aarch64.rpm libgfapi0-10.0-8.u1.fos23.aarch64.rpm libgfapi-devel-10.0-8.u1.fos23.aarch64.rpm libgfchangelog0-10.0-8.u1.fos23.aarch64.rpm libgfchangelog-devel-10.0-8.u1.fos23.aarch64.rpm libgfrpc0-10.0-8.u1.fos23.aarch64.rpm libgfrpc-devel-10.0-8.u1.fos23.aarch64.rpm libgfxdr0-10.0-8.u1.fos23.aarch64.rpm libgfxdr-devel-10.0-8.u1.fos23.aarch64.rpm libglusterd0-10.0-8.u1.fos23.aarch64.rpm python3-gluster-10.0-8.u1.fos23.aarch64.rpm glusterfs-server-10.0-8.u1.fos23.aarch64.rpm glusterfs-thin-arbiter-10.0-8.u1.fos23.aarch64.rpm glusterfs-client-xlators-10.0-8.u1.fos23.aarch64.rpm glusterfs-events-10.0-8.u1.fos23.aarch64.rpm FusionOS-SA-2023-2074 Important FusionOS CVE-2023-0361:A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection. FusionOS gnutls-3.7.2-7.u1.fos23.x86_64.rpm gnutls-devel-3.7.2-7.u1.fos23.x86_64.rpm gnutls-utils-3.7.2-7.u1.fos23.x86_64.rpm gnutls-help-3.7.2-7.u1.fos23.noarch.rpm gnutls-3.7.2-7.u1.fos23.aarch64.rpm gnutls-devel-3.7.2-7.u1.fos23.aarch64.rpm gnutls-utils-3.7.2-7.u1.fos23.aarch64.rpm FusionOS-SA-2023-2075 Important FusionOS CVE-2023-25950:HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive information or cause a denial-of-service (DoS) condition. FusionOS haproxy-2.6.6-3.u2.fos23.x86_64.rpm haproxy-help-2.6.6-3.u2.fos23.noarch.rpm haproxy-2.6.6-3.u2.fos23.aarch64.rpm FusionOS-SA-2023-2076 Critical FusionOS CVE-2018-13867:An issue was discovered in the HDF HDF5 1.8.20 library. There is an out of bounds read in the function H5F__accum_read in H5Faccum.c. CVE-2018-14031:An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer over-read in the function H5T_copy in H5T.c. CVE-2018-16438:An issue was discovered in the HDF HDF5 1.8.20 library. There is an out of bounds read in H5L_extern_query at H5Lexternal.c. CVE-2019-8396:A buffer overflow in H5O__layout_encode in H5Olayout.c in the HDF HDF5 through 1.10.4 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while repacking an HDF5 file, aka "Invalid write of size 2." CVE-2020-10812:An issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function H5F_get_nrefs() located in H5Fquery.c. It allows an attacker to cause Denial of Service. CVE-2021-37501:Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows attackers to cause a denial of service via h5tools_str_sprint in /hdf5/tools/lib/h5tools_str.c. FusionOS hdf5-1.12.1-4.u3.fos23.x86_64.rpm hdf5-devel-1.12.1-4.u3.fos23.x86_64.rpm hdf5-mpich-1.12.1-4.u3.fos23.x86_64.rpm hdf5-mpich-devel-1.12.1-4.u3.fos23.x86_64.rpm hdf5-mpich-static-1.12.1-4.u3.fos23.x86_64.rpm hdf5-openmpi-1.12.1-4.u3.fos23.x86_64.rpm hdf5-openmpi-devel-1.12.1-4.u3.fos23.x86_64.rpm hdf5-openmpi-static-1.12.1-4.u3.fos23.x86_64.rpm hdf5-1.12.1-4.u3.fos23.aarch64.rpm hdf5-devel-1.12.1-4.u3.fos23.aarch64.rpm hdf5-mpich-1.12.1-4.u3.fos23.aarch64.rpm hdf5-mpich-devel-1.12.1-4.u3.fos23.aarch64.rpm hdf5-mpich-static-1.12.1-4.u3.fos23.aarch64.rpm hdf5-openmpi-1.12.1-4.u3.fos23.aarch64.rpm hdf5-openmpi-devel-1.12.1-4.u3.fos23.aarch64.rpm hdf5-openmpi-static-1.12.1-4.u3.fos23.aarch64.rpm FusionOS-SA-2023-2077 Important FusionOS CVE-2022-2047:In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario. CVE-2022-2048:In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests. FusionOS jetty-9.4.16-3.u1.fos23.noarch.rpm jetty-client-9.4.16-3.u1.fos23.noarch.rpm jetty-continuation-9.4.16-3.u1.fos23.noarch.rpm jetty-http-9.4.16-3.u1.fos23.noarch.rpm jetty-http-spi-9.4.16-3.u1.fos23.noarch.rpm jetty-io-9.4.16-3.u1.fos23.noarch.rpm jetty-jaas-9.4.16-3.u1.fos23.noarch.rpm jetty-jsp-9.4.16-3.u1.fos23.noarch.rpm jetty-security-9.4.16-3.u1.fos23.noarch.rpm jetty-server-9.4.16-3.u1.fos23.noarch.rpm jetty-servlet-9.4.16-3.u1.fos23.noarch.rpm jetty-util-9.4.16-3.u1.fos23.noarch.rpm jetty-webapp-9.4.16-3.u1.fos23.noarch.rpm jetty-jmx-9.4.16-3.u1.fos23.noarch.rpm jetty-xml-9.4.16-3.u1.fos23.noarch.rpm jetty-project-9.4.16-3.u1.fos23.noarch.rpm jetty-deploy-9.4.16-3.u1.fos23.noarch.rpm jetty-annotations-9.4.16-3.u1.fos23.noarch.rpm jetty-ant-9.4.16-3.u1.fos23.noarch.rpm jetty-cdi-9.4.16-3.u1.fos23.noarch.rpm jetty-fcgi-client-9.4.16-3.u1.fos23.noarch.rpm jetty-fcgi-server-9.4.16-3.u1.fos23.noarch.rpm jetty-infinispan-9.4.16-3.u1.fos23.noarch.rpm jetty-jaspi-9.4.16-3.u1.fos23.noarch.rpm jetty-jndi-9.4.16-3.u1.fos23.noarch.rpm jetty-jspc-maven-plugin-9.4.16-3.u1.fos23.noarch.rpm jetty-maven-plugin-9.4.16-3.u1.fos23.noarch.rpm jetty-plus-9.4.16-3.u1.fos23.noarch.rpm jetty-proxy-9.4.16-3.u1.fos23.noarch.rpm jetty-rewrite-9.4.16-3.u1.fos23.noarch.rpm jetty-servlets-9.4.16-3.u1.fos23.noarch.rpm jetty-spring-9.4.16-3.u1.fos23.noarch.rpm jetty-start-9.4.16-3.u1.fos23.noarch.rpm jetty-unixsocket-9.4.16-3.u1.fos23.noarch.rpm jetty-util-ajax-9.4.16-3.u1.fos23.noarch.rpm jetty-websocket-api-9.4.16-3.u1.fos23.noarch.rpm jetty-websocket-client-9.4.16-3.u1.fos23.noarch.rpm jetty-websocket-common-9.4.16-3.u1.fos23.noarch.rpm jetty-websocket-server-9.4.16-3.u1.fos23.noarch.rpm jetty-websocket-servlet-9.4.16-3.u1.fos23.noarch.rpm jetty-javax-websocket-client-impl-9.4.16-3.u1.fos23.noarch.rpm jetty-javax-websocket-server-impl-9.4.16-3.u1.fos23.noarch.rpm jetty-nosql-9.4.16-3.u1.fos23.noarch.rpm jetty-httpservice-9.4.16-3.u1.fos23.noarch.rpm jetty-osgi-boot-9.4.16-3.u1.fos23.noarch.rpm jetty-osgi-boot-warurl-9.4.16-3.u1.fos23.noarch.rpm jetty-osgi-boot-jsp-9.4.16-3.u1.fos23.noarch.rpm jetty-osgi-alpn-9.4.16-3.u1.fos23.noarch.rpm jetty-quickstart-9.4.16-3.u1.fos23.noarch.rpm jetty-alpn-client-9.4.16-3.u1.fos23.noarch.rpm jetty-alpn-server-9.4.16-3.u1.fos23.noarch.rpm jetty-http2-client-9.4.16-3.u1.fos23.noarch.rpm jetty-http2-common-9.4.16-3.u1.fos23.noarch.rpm jetty-http2-hpack-9.4.16-3.u1.fos23.noarch.rpm jetty-http2-http-client-transport-9.4.16-3.u1.fos23.noarch.rpm jetty-http2-server-9.4.16-3.u1.fos23.noarch.rpm jetty-jstl-9.4.16-3.u1.fos23.noarch.rpm jetty-javadoc-9.4.16-3.u1.fos23.noarch.rpm FusionOS-SA-2023-2078 Important FusionOS CVE-2023-1370:[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software. FusionOS json-smart-2.2-2.u1.fos23.noarch.rpm json-smart-javadoc-2.2-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2079 Important FusionOS CVE-2022-36280:An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). CVE-2022-4269:A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of service condition. CVE-2022-48423:In the Linux kernel before 6.1.3, fs/ntfs3/record.c does not validate resident attribute names. An out-of-bounds write may occur. CVE-2022-48424:In the Linux kernel before 6.1.3, fs/ntfs3/inode.c does not validate the attribute name offset. An unhandled page fault may occur. CVE-2022-48425:In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs. CVE-2023-0266:A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e CVE-2023-1079:A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconnecting in a malicious USB device, which advertises itself as an Asus device. Similarly to the previous known CVE-2023-25012, but in asus devices, the work_struct may be scheduled by the LED controller while the device is disconnecting, triggering a use-after-free on the struct asus_kbd_leds *led structure. A malicious USB device may exploit the issue to cause memory corruption with controlled data. CVE-2023-1249:A use-after-free flaw was found in the Linux kernel’s core dump subsystem. This flaw allows a local user to crash the system. Only if patch 390031c94211 ("coredump: Use the vma snapshot in fill_files_note") not applied yet, then kernel could be affected. CVE-2023-1281:Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. CVE-2023-1380:in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service. CVE-2023-1382:A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc protocol in the Linux kernel. CVE-2023-1513:A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak. CVE-2023-1611:A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allows an attacker to crash the system and possibly cause a kernel information lea CVE-2023-1670:A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was found.A local user could use this flaw to crash the system or potentially escalate their privileges on the system. CVE-2023-1855:A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel Driver (xgene-hwmon). This flaw could allow a local attacker to crash the system due to a race problem. This vulnerability could even lead to a kernel information leak problem. CVE-2023-1859:A use-after-free flaw was found in xen_9pfs_front_removet in net/9p/trans_xen.c in Xen transport for 9pfs in the Linux Kernel. This flaw could allow a local attacker to crash the system due to a race problem, possibly leading to a kernel information leak. CVE-2023-1872:A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local privilege escalation. The io_file_get_fixed function lacks the presence of ctx->uring_lock which can lead to a Use-After-Free vulnerability due a race condition with fixed files getting unregistered. We recommend upgrading past commit CVE-2023-1989:A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. In this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on hdev devices. CVE-2023-1990:A use-after-free flaw was found in ndlc_remove in drivers/nfc/st-nci/ndlc.c in the Linux Kernel. This flaw could allow an attacker to crash the system due to a race problem. CVE-2023-1998:The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line. This happened because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection. However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons, which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target injection against which STIBP protects. CVE-2023-2006:A race condition was found in the Linux kernel's RxRPC network protocol, within the processing of RxRPC bundles. This issue results from the lack of proper locking when performing operations on an object. This may allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel. CVE-2023-28327:Reference:https://lore.kernel.org/netdev/CAO4mrfdvyjFpokhNsiwZiP-wpdSD0AStcJwfKcKQdAALQ9_2Qw@mail.gmail.com/https://lore.kernel.org/netdev/e04315e7c90d9a75613f3993c2baf2d344eef7eb.camel@redhat.com/https://lore.kernel.org/netdev/20221127012412.37969-3-kuniyu@amazon.com/T/ CVE-2023-28328:A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service. CVE-2023-28466:do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference). CVE-2023-30456:An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency checks for CR0 and CR4. CVE-2023-30772:The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/power/supply/da9150-charger.c if a physically proximate attacker unplugs a device. FusionOS kernel-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm kernel-headers-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm kernel-devel-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm kernel-tools-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm perf-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm python3-perf-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm bpftool-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm kernel-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm kernel-headers-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm kernel-devel-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm kernel-tools-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm perf-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm python3-perf-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm bpftool-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm FusionOS-SA-2023-2080 Important FusionOS CVE-2020-12762:json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. FusionOS libfastjson-0.99.9-3.u1.fos23.x86_64.rpm libfastjson-devel-0.99.9-3.u1.fos23.x86_64.rpm libfastjson-0.99.9-3.u1.fos23.aarch64.rpm libfastjson-devel-0.99.9-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2081 Moderate FusionOS CVE-2023-0614:The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC. FusionOS libldb-2.6.1-2.u1.fos23.x86_64.rpm libldb-devel-2.6.1-2.u1.fos23.x86_64.rpm python-ldb-devel-common-2.6.1-2.u1.fos23.x86_64.rpm python3-ldb-2.6.1-2.u1.fos23.x86_64.rpm python3-ldb-devel-2.6.1-2.u1.fos23.x86_64.rpm libldb-help-2.6.1-2.u1.fos23.noarch.rpm libldb-2.6.1-2.u1.fos23.aarch64.rpm libldb-devel-2.6.1-2.u1.fos23.aarch64.rpm python-ldb-devel-common-2.6.1-2.u1.fos23.aarch64.rpm python3-ldb-2.6.1-2.u1.fos23.aarch64.rpm python3-ldb-devel-2.6.1-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2082 Important FusionOS CVE-2023-26769:Buffer Overflow vulnerability found in Liblouis Lou_Trace v.3.24.0 allows a remote attacker to cause a denial of service via the resolveSubtable function at compileTranslationTabel.c. FusionOS liblouis-3.7.0-5.u2.fos23.x86_64.rpm liblouis-devel-3.7.0-5.u2.fos23.x86_64.rpm liblouis-utils-3.7.0-5.u2.fos23.x86_64.rpm liblouis-help-3.7.0-5.u2.fos23.noarch.rpm python3-louis-3.7.0-5.u2.fos23.noarch.rpm liblouis-3.7.0-5.u2.fos23.aarch64.rpm liblouis-devel-3.7.0-5.u2.fos23.aarch64.rpm liblouis-utils-3.7.0-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2083 Moderate FusionOS CVE-2023-28484:In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c. CVE-2023-29469:An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value). FusionOS libxml2-2.9.14-5.u1.fos23.x86_64.rpm libxml2-devel-2.9.14-5.u1.fos23.x86_64.rpm python3-libxml2-2.9.14-5.u1.fos23.x86_64.rpm libxml2-help-2.9.14-5.u1.fos23.noarch.rpm libxml2-2.9.14-5.u1.fos23.aarch64.rpm libxml2-devel-2.9.14-5.u1.fos23.aarch64.rpm python3-libxml2-2.9.14-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2084 Important FusionOS CVE-2021-45985:In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read. FusionOS lua-5.4.3-11.u2.fos23.x86_64.rpm lua-devel-5.4.3-11.u2.fos23.x86_64.rpm lua-help-5.4.3-11.u2.fos23.noarch.rpm lua-5.4.3-11.u2.fos23.aarch64.rpm lua-devel-5.4.3-11.u2.fos23.aarch64.rpm FusionOS-SA-2023-2085 Important FusionOS CVE-2022-44370:NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856 FusionOS nasm-2.15.05-5.u2.fos23.x86_64.rpm nasm-help-2.15.05-5.u2.fos23.noarch.rpm nasm-2.15.05-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2086 Important FusionOS CVE-2023-0464:A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. CVE-2023-0465:Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. CVE-2023-0466:The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications. FusionOS openssl-1.1.1m-19.u5.fos23.x86_64.rpm openssl-libs-1.1.1m-19.u5.fos23.x86_64.rpm openssl-perl-1.1.1m-19.u5.fos23.x86_64.rpm openssl-devel-1.1.1m-19.u5.fos23.x86_64.rpm openssl-help-1.1.1m-19.u5.fos23.noarch.rpm openssl-1.1.1m-19.u5.fos23.aarch64.rpm openssl-libs-1.1.1m-19.u5.fos23.aarch64.rpm openssl-perl-1.1.1m-19.u5.fos23.aarch64.rpm openssl-devel-1.1.1m-19.u5.fos23.aarch64.rpm FusionOS-SA-2023-2087 Important FusionOS CVE-2023-1668:A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow. FusionOS openvswitch-2.12.4-3.u2.fos23.x86_64.rpm openvswitch-devel-2.12.4-3.u2.fos23.x86_64.rpm openvswitch-help-2.12.4-3.u2.fos23.x86_64.rpm python3-openvswitch-2.12.4-3.u2.fos23.noarch.rpm openvswitch-2.12.4-3.u2.fos23.aarch64.rpm openvswitch-devel-2.12.4-3.u2.fos23.aarch64.rpm openvswitch-help-2.12.4-3.u2.fos23.aarch64.rpm FusionOS-SA-2023-2088 Moderate FusionOS CVE-2022-40897:Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py. FusionOS python-setuptools-59.4.0-5.u1.fos23.noarch.rpm python3-setuptools-59.4.0-5.u1.fos23.noarch.rpm python-setuptools-help-59.4.0-5.u1.fos23.noarch.rpm FusionOS-SA-2023-2089 Important FusionOS CVE-2023-24329:An issue in the urllib.parse component of Python before v3.11 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. FusionOS python3-3.9.9-24.u3.fos23.x86_64.rpm python3-unversioned-command-3.9.9-24.u3.fos23.x86_64.rpm python3-devel-3.9.9-24.u3.fos23.x86_64.rpm python3-debug-3.9.9-24.u3.fos23.x86_64.rpm python3-help-3.9.9-24.u3.fos23.noarch.rpm python3-3.9.9-24.u3.fos23.aarch64.rpm python3-unversioned-command-3.9.9-24.u3.fos23.aarch64.rpm python3-devel-3.9.9-24.u3.fos23.aarch64.rpm python3-debug-3.9.9-24.u3.fos23.aarch64.rpm FusionOS-SA-2023-2090 Moderate FusionOS CVE-2022-36021:Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. FusionOS redis5-5.0.7-5.u1.fos23.x86_64.rpm redis5-devel-5.0.7-5.u1.fos23.x86_64.rpm redis5-doc-5.0.7-5.u1.fos23.noarch.rpm redis5-5.0.7-5.u1.fos23.aarch64.rpm redis5-devel-5.0.7-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2091 Moderate FusionOS CVE-2022-36021:Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. FusionOS redis6-6.2.7-2.u1.fos23.x86_64.rpm redis6-devel-6.2.7-2.u1.fos23.x86_64.rpm redis6-doc-6.2.7-2.u1.fos23.noarch.rpm redis6-6.2.7-2.u1.fos23.aarch64.rpm redis6-devel-6.2.7-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2092 Important FusionOS CVE-2023-28755:A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. CVE-2023-28756:A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. FusionOS ruby-3.0.3-129.u2.fos23.x86_64.rpm ruby-devel-3.0.3-129.u2.fos23.x86_64.rpm rubygems-3.2.32-129.u2.fos23.noarch.rpm rubygems-devel-3.2.32-129.u2.fos23.noarch.rpm rubygem-rake-13.0.3-129.u2.fos23.noarch.rpm rubygem-rbs-1.4.0-129.u2.fos23.noarch.rpm ruby-irb-3.0.3-129.u2.fos23.noarch.rpm rubygem-rdoc-6.3.3-129.u2.fos23.noarch.rpm ruby-help-3.0.3-129.u2.fos23.noarch.rpm rubygem-bigdecimal-3.0.0-129.u2.fos23.x86_64.rpm rubygem-did_you_mean-1.5.0-129.u2.fos23.noarch.rpm rubygem-io-console-0.5.7-129.u2.fos23.x86_64.rpm rubygem-json-2.5.1-129.u2.fos23.x86_64.rpm rubygem-minitest-5.14.2-129.u2.fos23.noarch.rpm rubygem-openssl-2.2.1-129.u2.fos23.x86_64.rpm rubygem-power_assert-1.2.0-129.u2.fos23.noarch.rpm rubygem-psych-3.3.2-129.u2.fos23.x86_64.rpm rubygem-test-unit-3.3.7-129.u2.fos23.noarch.rpm rubygem-rexml-3.2.5-129.u2.fos23.noarch.rpm rubygem-rss-0.2.9-129.u2.fos23.noarch.rpm rubygem-typeprof-0.15.2-129.u2.fos23.noarch.rpm ruby-3.0.3-129.u2.fos23.aarch64.rpm ruby-devel-3.0.3-129.u2.fos23.aarch64.rpm rubygem-bigdecimal-3.0.0-129.u2.fos23.aarch64.rpm rubygem-io-console-0.5.7-129.u2.fos23.aarch64.rpm rubygem-json-2.5.1-129.u2.fos23.aarch64.rpm rubygem-openssl-2.2.1-129.u2.fos23.aarch64.rpm rubygem-psych-3.3.2-129.u2.fos23.aarch64.rpm FusionOS-SA-2023-2093 Important FusionOS CVE-2023-28642:runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image. FusionOS runc-1.1.3-11.u3.fos23.x86_64.rpm runc-1.1.3-11.u3.fos23.aarch64.rpm FusionOS-SA-2023-2094 Moderate FusionOS CVE-2023-24626:socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows local users to send a privileged SIGHUP signal to any PID, causing a denial of service or disruption of the target process. FusionOS screen-4.9.0-2.u1.fos23.x86_64.rpm screen-help-4.9.0-2.u1.fos23.noarch.rpm screen-4.9.0-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2095 Low FusionOS CVE-2023-29383:In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account. FusionOS shadow-4.9-9.u3.fos23.x86_64.rpm shadow-subid-devel-4.9-9.u3.fos23.x86_64.rpm shadow-help-4.9-9.u3.fos23.noarch.rpm shadow-4.9-9.u3.fos23.aarch64.rpm shadow-subid-devel-4.9-9.u3.fos23.aarch64.rpm FusionOS-SA-2023-2096 Important FusionOS CVE-2022-46908:SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE. FusionOS sqlite-3.37.2-5.u2.fos23.x86_64.rpm sqlite-devel-3.37.2-5.u2.fos23.x86_64.rpm sqlite-help-3.37.2-5.u2.fos23.noarch.rpm sqlite-3.37.2-5.u2.fos23.aarch64.rpm sqlite-devel-3.37.2-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2097 Moderate FusionOS CVE-2023-28486:Sudo before 1.9.13 does not escape control characters in log messages. CVE-2023-28487:Sudo before 1.9.13 does not escape control characters in sudoreplay output. FusionOS sudo-1.9.8p2-10.u4.fos23.x86_64.rpm sudo-devel-1.9.8p2-10.u4.fos23.x86_64.rpm sudo-help-1.9.8p2-10.u4.fos23.noarch.rpm sudo-1.9.8p2-10.u4.fos23.aarch64.rpm sudo-devel-1.9.8p2-10.u4.fos23.aarch64.rpm FusionOS-SA-2023-2098 Moderate FusionOS CVE-2023-1801:The SMB protocol decoder in tcpdump version 4.99.3 can perform an out-of-bounds write when decoding a crafted network packet. FusionOS tcpdump-4.99.1-6.u1.fos23.x86_64.rpm tcpdump-help-4.99.1-6.u1.fos23.x86_64.rpm tcpdump-4.99.1-6.u1.fos23.aarch64.rpm tcpdump-help-4.99.1-6.u1.fos23.aarch64.rpm FusionOS-SA-2023-2099 Moderate FusionOS CVE-2023-28708:When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. FusionOS tomcat-9.0.10-30.u5.fos23.noarch.rpm tomcat-jsvc-9.0.10-30.u5.fos23.noarch.rpm tomcat-help-9.0.10-30.u5.fos23.noarch.rpm FusionOS-SA-2023-2100 Important FusionOS CVE-2023-1108:A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates. FusionOS undertow-1.4.0-4.u1.fos23.noarch.rpm undertow-javadoc-1.4.0-4.u1.fos23.noarch.rpm FusionOS-SA-2023-2101 Moderate FusionOS CVE-2023-1264:NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392. FusionOS vim-common-9.0-12.u5.fos23.x86_64.rpm vim-minimal-9.0-12.u5.fos23.x86_64.rpm vim-enhanced-9.0-12.u5.fos23.x86_64.rpm vim-filesystem-9.0-12.u5.fos23.noarch.rpm vim-X11-9.0-12.u5.fos23.x86_64.rpm vim-common-9.0-12.u5.fos23.aarch64.rpm vim-minimal-9.0-12.u5.fos23.aarch64.rpm vim-enhanced-9.0-12.u5.fos23.aarch64.rpm vim-X11-9.0-12.u5.fos23.aarch64.rpm FusionOS-SA-2023-2102 Important FusionOS CVE-2023-1992:RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file CVE-2023-1993:LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file CVE-2023-1994:GQUIC dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file FusionOS wireshark-3.6.11-3.u2.fos23.x86_64.rpm wireshark-devel-3.6.11-3.u2.fos23.x86_64.rpm wireshark-help-3.6.11-3.u2.fos23.x86_64.rpm wireshark-3.6.11-3.u2.fos23.aarch64.rpm wireshark-devel-3.6.11-3.u2.fos23.aarch64.rpm wireshark-help-3.6.11-3.u2.fos23.aarch64.rpm FusionOS-SA-2023-2103 Important FusionOS CVE-2023-1393:A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client explicitly destroys the compositor overlay window (aka COW), the Xserver would leave a dangling pointer to that window in the CompScreen structure, which will trigger a use-after-free later. FusionOS xorg-x11-server-1.20.11-18.u5.fos23.x86_64.rpm xorg-x11-server-common-1.20.11-18.u5.fos23.x86_64.rpm xorg-x11-server-Xnest-1.20.11-18.u5.fos23.x86_64.rpm xorg-x11-server-Xdmx-1.20.11-18.u5.fos23.x86_64.rpm xorg-x11-server-Xvfb-1.20.11-18.u5.fos23.x86_64.rpm xorg-x11-server-Xephyr-1.20.11-18.u5.fos23.x86_64.rpm xorg-x11-server-devel-1.20.11-18.u5.fos23.x86_64.rpm xorg-x11-server-help-1.20.11-18.u5.fos23.noarch.rpm xorg-x11-server-source-1.20.11-18.u5.fos23.noarch.rpm xorg-x11-server-1.20.11-18.u5.fos23.aarch64.rpm xorg-x11-server-common-1.20.11-18.u5.fos23.aarch64.rpm xorg-x11-server-Xnest-1.20.11-18.u5.fos23.aarch64.rpm xorg-x11-server-Xdmx-1.20.11-18.u5.fos23.aarch64.rpm xorg-x11-server-Xvfb-1.20.11-18.u5.fos23.aarch64.rpm xorg-x11-server-Xephyr-1.20.11-18.u5.fos23.aarch64.rpm xorg-x11-server-devel-1.20.11-18.u5.fos23.aarch64.rpm FusionOS-SA-2023-2104 Important FusionOS CVE-2022-4899:A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun. FusionOS zstd-1.5.0-4.u2.fos23.x86_64.rpm zstd-devel-1.5.0-4.u2.fos23.x86_64.rpm zstd-help-1.5.0-4.u2.fos23.noarch.rpm zstd-1.5.0-4.u2.fos23.aarch64.rpm zstd-devel-1.5.0-4.u2.fos23.aarch64.rpm FusionOS-SA-2023-2105 Moderate FusionOS CVE-2023-1729:A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a maliciously crafted file may lead to an application crash. FusionOS LibRaw-0.20.2-6.u1.fos23.x86_64.rpm LibRaw-devel-0.20.2-6.u1.fos23.x86_64.rpm LibRaw-0.20.2-6.u1.fos23.aarch64.rpm LibRaw-devel-0.20.2-6.u1.fos23.aarch64.rpm FusionOS-SA-2023-2106 Important FusionOS CVE-2022-3736 :BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1. CVE-2022-3924:This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero. If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessary to SERVFAIL the longest waiting client (see BIND 9 ARM `recursive-clients` limit and soft quota), then it is possible for a race to occur between providing a stale answer to this older client and sending an early timeout SERVFAIL, which may cause an assertion failure. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1. CVE-2022-3094:Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free memory. We are not aware of any cases where this has been exploited. Memory is allocated prior to the checking of access permissions (ACLs) and is retained during the processing of a dynamic update from a client whose access credentials are accepted. Memory allocated to clients that are not permitted to send updates is released immediately upon rejection. The scope of this vulnerability is limited therefore to trusted clients who are permitted to make dynamic zone changes. If a dynamic update is REFUSED, memory will be released again very quickly. Therefore it is only likely to be possible to degrade or stop `named` by sending a flood of unaccepted dynamic updates comparable in magnitude to a query flood intended to achieve the same detrimental outcome. BIND 9.11 and earlier branches are also affected, but through exhaustion of internal resources rather than memory constraints. This may reduce performance but should not be a significant problem for most servers. Therefore we don't intend to address this for BIND versions prior to BIND 9.16. This issue affects BIND 9 versions 9.16.0 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.8-S1 through 9.16.36-S1. FusionOS bind-9.16.23-14.u3.fos23.x86_64.rpm bind-pkcs11-9.16.23-14.u3.fos23.x86_64.rpm bind-pkcs11-utils-9.16.23-14.u3.fos23.x86_64.rpm bind-pkcs11-libs-9.16.23-14.u3.fos23.x86_64.rpm bind-pkcs11-devel-9.16.23-14.u3.fos23.x86_64.rpm bind-libs-9.16.23-14.u3.fos23.x86_64.rpm bind-license-9.16.23-14.u3.fos23.noarch.rpm bind-utils-9.16.23-14.u3.fos23.x86_64.rpm bind-dnssec-utils-9.16.23-14.u3.fos23.x86_64.rpm bind-dnssec-doc-9.16.23-14.u3.fos23.noarch.rpm bind-devel-9.16.23-14.u3.fos23.x86_64.rpm bind-chroot-9.16.23-14.u3.fos23.x86_64.rpm python3-bind-9.16.23-14.u3.fos23.noarch.rpm bind-9.16.23-14.u3.fos23.aarch64.rpm bind-pkcs11-9.16.23-14.u3.fos23.aarch64.rpm bind-pkcs11-utils-9.16.23-14.u3.fos23.aarch64.rpm bind-pkcs11-libs-9.16.23-14.u3.fos23.aarch64.rpm bind-pkcs11-devel-9.16.23-14.u3.fos23.aarch64.rpm bind-libs-9.16.23-14.u3.fos23.aarch64.rpm bind-utils-9.16.23-14.u3.fos23.aarch64.rpm bind-dnssec-utils-9.16.23-14.u3.fos23.aarch64.rpm bind-devel-9.16.23-14.u3.fos23.aarch64.rpm bind-chroot-9.16.23-14.u3.fos23.aarch64.rpm FusionOS-SA-2023-2107 Important FusionOS CVE-2023-25815:In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer uses the runtime prefix but uses the hard-coded path `C:\mingw64\share\locale` to look for localized messages. And since any authenticated user has the permission to create folders in `C:\` (and since `C:\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in that location where `git.exe` will pick them up in version 2.40.1. This vulnerability is relatively hard to exploit and requires social engineering. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website, and the user might think that the message comes from Git and is legitimate. It does require local write access by the attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or alternatively create a `C:\mingw64` folder and leave it empty. Users who have administrative rights may remove the permission to create folders in `C:\`. CVE-2023-29007:Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`. CVE-2023-25652:Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists. FusionOS git-2.33.0-11.u3.fos23.x86_64.rpm git-core-2.33.0-11.u3.fos23.x86_64.rpm git-daemon-2.33.0-11.u3.fos23.x86_64.rpm git-gui-2.33.0-11.u3.fos23.noarch.rpm gitk-2.33.0-11.u3.fos23.noarch.rpm git-web-2.33.0-11.u3.fos23.noarch.rpm git-svn-2.33.0-11.u3.fos23.noarch.rpm git-email-2.33.0-11.u3.fos23.noarch.rpm perl-Git-2.33.0-11.u3.fos23.noarch.rpm perl-Git-SVN-2.33.0-11.u3.fos23.noarch.rpm git-help-2.33.0-11.u3.fos23.noarch.rpm git-2.33.0-11.u3.fos23.aarch64.rpm git-core-2.33.0-11.u3.fos23.aarch64.rpm git-daemon-2.33.0-11.u3.fos23.aarch64.rpm FusionOS-SA-2023-2108 Critical FusionOS CVE-2023-29400:Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags. CVE-2023-24540:Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution. CVE-2023-24539:Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input. CVE-2023-24538:Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. With fix, Template.Parse returns an Error when it encounters templates like this, with an ErrorCode of value 12. CVE-2023-24537:Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow. CVE-2023-24536:Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed, leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3. ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage collector. The combination of these factors can permit an attacker to cause an program that parses multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service. This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. With fix, ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many fewer short-lived allocations. In addition, the fixed mime/multipart.Reader imposes the following limits on the size of parsed forms: 1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxparts=. 2. Form parts parsed with NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxheaders=. CVE-2023-24534:HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers. CVE-2023-24532:The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages of crypto/ecdsa or crypto/ecdh. CVE-2022-41725:A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. CVE-2022-41724:Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert). CVE-2022-41723:A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests. CVE-2022-41722:A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b". FusionOS golang-1.19.4-1.u2.fos23.x86_64.rpm golang-help-1.19.4-1.u2.fos23.noarch.rpm golang-devel-1.19.4-1.u2.fos23.noarch.rpm golang-1.19.4-1.u2.fos23.aarch64.rpm FusionOS-SA-2023-2109 Important FusionOS CVE-2023-1829:A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root. CVE-2022-4382:A use-after-free flaw caused by a race among the superblock operations in the gadgetfs Linux driver was found. It could be triggered by yanking out a device that is running the gadgetfs side. CVE-2023-0458:A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. CVE-2023-2269:A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component. CVE-2023-2483:In emac_probe, &adpt->work_thread is bound with emac_work_thread. Then it will be started by timeout handler emac_tx_timeout or a IRQ handler emac_isr. If we remove the driver which will call emac_remove to make cleanup, there may be a unfinished work. This could lead to a use-after-free. CVE-2023-31436:qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX. CVE-2023-2176:A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem to crash the system or escalation of privilege. CVE-2023-2194:An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to crash the system or potentially achieve code execution. CVE-2023-2166:A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to crash the system or potentially cause a denial of service. CVE-2023-2007:The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel. FusionOS kernel-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm kernel-headers-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm kernel-devel-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm kernel-tools-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm perf-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm python3-perf-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm bpftool-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm kernel-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm kernel-headers-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm kernel-devel-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm kernel-tools-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm perf-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm python3-perf-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm bpftool-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm FusionOS-SA-2023-2110 Important FusionOS CVE-2023-28625:mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using `OIDCStripCookies`. FusionOS mod_auth_openidc-2.4.13.2-1.fos23.x86_64.rpm mod_auth_openidc-2.4.13.2-1.fos23.aarch64.rpm FusionOS-SA-2023-2111 Critical FusionOS CVE-2022-37434:zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference). FusionOS mysql-8.0.29-2.u1.fos23.x86_64.rpm mysql-libs-8.0.29-2.u1.fos23.x86_64.rpm mysql-config-8.0.29-2.u1.fos23.x86_64.rpm mysql-common-8.0.29-2.u1.fos23.x86_64.rpm mysql-errmsg-8.0.29-2.u1.fos23.x86_64.rpm mysql-server-8.0.29-2.u1.fos23.x86_64.rpm mysql-devel-8.0.29-2.u1.fos23.x86_64.rpm mysql-test-8.0.29-2.u1.fos23.x86_64.rpm mysql-help-8.0.29-2.u1.fos23.x86_64.rpm mysql-8.0.29-2.u1.fos23.aarch64.rpm mysql-libs-8.0.29-2.u1.fos23.aarch64.rpm mysql-config-8.0.29-2.u1.fos23.aarch64.rpm mysql-common-8.0.29-2.u1.fos23.aarch64.rpm mysql-errmsg-8.0.29-2.u1.fos23.aarch64.rpm mysql-server-8.0.29-2.u1.fos23.aarch64.rpm mysql-devel-8.0.29-2.u1.fos23.aarch64.rpm mysql-test-8.0.29-2.u1.fos23.aarch64.rpm mysql-help-8.0.29-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2112 Important FusionOS CVE-2023-31484:CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. FusionOS perl-5.34.0-7.u1.fos23.x86_64.rpm perl-libs-5.34.0-7.u1.fos23.x86_64.rpm perl-devel-5.34.0-7.u1.fos23.x86_64.rpm perl-help-5.34.0-7.u1.fos23.noarch.rpm perl-5.34.0-7.u1.fos23.aarch64.rpm perl-libs-5.34.0-7.u1.fos23.aarch64.rpm perl-devel-5.34.0-7.u1.fos23.aarch64.rpm FusionOS-SA-2023-2113 Important FusionOS CVE-2022-38023:Netlogon RPC Elevation of Privilege Vulnerability. CVE-2022-37966:Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability CVE-2022-37967:Windows Kerberos Elevation of Privilege Vulnerability FusionOS samba-4.17.5-2.fos23.x86_64.rpm samba-libs-4.17.5-2.fos23.x86_64.rpm samba-client-4.17.5-2.fos23.x86_64.rpm samba-common-4.17.5-2.fos23.x86_64.rpm samba-common-tools-4.17.5-2.fos23.x86_64.rpm samba-dc-4.17.5-2.fos23.x86_64.rpm samba-dc-provision-4.17.5-2.fos23.x86_64.rpm samba-dc-bind-dlz-4.17.5-2.fos23.x86_64.rpm samba-devel-4.17.5-2.fos23.x86_64.rpm samba-vfs-glusterfs-4.17.5-2.fos23.x86_64.rpm samba-krb5-printing-4.17.5-2.fos23.x86_64.rpm libsmbclient-4.17.5-2.fos23.x86_64.rpm libsmbclient-devel-4.17.5-2.fos23.x86_64.rpm libwbclient-4.17.5-2.fos23.x86_64.rpm libwbclient-devel-4.17.5-2.fos23.x86_64.rpm python3-samba-4.17.5-2.fos23.x86_64.rpm python3-samba-test-4.17.5-2.fos23.x86_64.rpm python3-samba-dc-4.17.5-2.fos23.x86_64.rpm samba-pidl-4.17.5-2.fos23.noarch.rpm samba-test-4.17.5-2.fos23.x86_64.rpm samba-usershares-4.17.5-2.fos23.x86_64.rpm samba-winbind-4.17.5-2.fos23.x86_64.rpm samba-winbind-clients-4.17.5-2.fos23.x86_64.rpm samba-winbind-krb5-locator-4.17.5-2.fos23.x86_64.rpm samba-winbind-modules-4.17.5-2.fos23.x86_64.rpm ctdb-4.17.5-2.fos23.x86_64.rpm samba-help-4.17.5-2.fos23.x86_64.rpm samba-4.17.5-2.fos23.aarch64.rpm samba-libs-4.17.5-2.fos23.aarch64.rpm samba-client-4.17.5-2.fos23.aarch64.rpm samba-common-4.17.5-2.fos23.aarch64.rpm samba-common-tools-4.17.5-2.fos23.aarch64.rpm samba-dc-4.17.5-2.fos23.aarch64.rpm samba-dc-provision-4.17.5-2.fos23.aarch64.rpm samba-dc-bind-dlz-4.17.5-2.fos23.aarch64.rpm samba-devel-4.17.5-2.fos23.aarch64.rpm samba-krb5-printing-4.17.5-2.fos23.aarch64.rpm libsmbclient-4.17.5-2.fos23.aarch64.rpm libsmbclient-devel-4.17.5-2.fos23.aarch64.rpm libwbclient-4.17.5-2.fos23.aarch64.rpm libwbclient-devel-4.17.5-2.fos23.aarch64.rpm python3-samba-4.17.5-2.fos23.aarch64.rpm python3-samba-test-4.17.5-2.fos23.aarch64.rpm python3-samba-dc-4.17.5-2.fos23.aarch64.rpm samba-test-4.17.5-2.fos23.aarch64.rpm samba-usershares-4.17.5-2.fos23.aarch64.rpm samba-winbind-4.17.5-2.fos23.aarch64.rpm samba-winbind-clients-4.17.5-2.fos23.aarch64.rpm samba-winbind-krb5-locator-4.17.5-2.fos23.aarch64.rpm samba-winbind-modules-4.17.5-2.fos23.aarch64.rpm ctdb-4.17.5-2.fos23.aarch64.rpm samba-help-4.17.5-2.fos23.aarch64.rpm FusionOS-SA-2023-2114 Important FusionOS CVE-2023-34151:A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting double to size_t in svg, mvg and other coders (recurring bugs of CVE-2022-32546). CVE-2023-34153:A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding. FusionOS ImageMagick-7.1.1.8-2.u2.fos23.x86_64.rpm ImageMagick-devel-7.1.1.8-2.u2.fos23.x86_64.rpm ImageMagick-help-7.1.1.8-2.u2.fos23.x86_64.rpm ImageMagick-perl-7.1.1.8-2.u2.fos23.x86_64.rpm ImageMagick-c++-7.1.1.8-2.u2.fos23.x86_64.rpm ImageMagick-c++-devel-7.1.1.8-2.u2.fos23.x86_64.rpm ImageMagick-7.1.1.8-2.u2.fos23.aarch64.rpm ImageMagick-devel-7.1.1.8-2.u2.fos23.aarch64.rpm ImageMagick-help-7.1.1.8-2.u2.fos23.aarch64.rpm ImageMagick-perl-7.1.1.8-2.u2.fos23.aarch64.rpm ImageMagick-c++-7.1.1.8-2.u2.fos23.aarch64.rpm ImageMagick-c++-devel-7.1.1.8-2.u2.fos23.aarch64.rpm FusionOS-SA-2023-2115 Important FusionOS CVE-2023-31130:c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1. CVE-2023-32067:c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1. CVE-2023-31124:c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1. CVE-2023-31147:c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1. FusionOS c-ares-1.18.1-7.u3.fos23.x86_64.rpm c-ares-devel-1.18.1-7.u3.fos23.x86_64.rpm c-ares-help-1.18.1-7.u3.fos23.noarch.rpm c-ares-1.18.1-7.u3.fos23.aarch64.rpm c-ares-devel-1.18.1-7.u3.fos23.aarch64.rpm FusionOS-SA-2023-2116 Moderate FusionOS CVE-2022-2084:Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords. CVE-2023-1786:Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege. FusionOS cloud-init-21.4-16.u8.fos23.noarch.rpm cloud-init-help-21.4-16.u8.fos23.noarch.rpm FusionOS-SA-2023-2117 Low FusionOS CVE-2015-1197:cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive. FusionOS cpio-2.13-8.u1.fos23.x86_64.rpm cpio-help-2.13-8.u1.fos23.noarch.rpm cpio-2.13-8.u1.fos23.aarch64.rpm FusionOS-SA-2023-2118 Moderate FusionOS CVE-2023-32324:OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service (DoS) attack. A buffer overflow vulnerability in the function `format_log_line` could allow remote attackers to cause a DoS on the affected system. Exploitation of the vulnerability can be triggered when the configuration file `cupsd.conf` sets the value of `loglevel `to `DEBUG`. FusionOS cups-2.4.0-7.u2.fos23.x86_64.rpm cups-client-2.4.0-7.u2.fos23.x86_64.rpm cups-devel-2.4.0-7.u2.fos23.x86_64.rpm cups-libs-2.4.0-7.u2.fos23.x86_64.rpm cups-filesystem-2.4.0-7.u2.fos23.noarch.rpm cups-lpd-2.4.0-7.u2.fos23.x86_64.rpm cups-ipptool-2.4.0-7.u2.fos23.x86_64.rpm cups-printerapp-2.4.0-7.u2.fos23.x86_64.rpm cups-help-2.4.0-7.u2.fos23.noarch.rpm cups-2.4.0-7.u2.fos23.aarch64.rpm cups-client-2.4.0-7.u2.fos23.aarch64.rpm cups-devel-2.4.0-7.u2.fos23.aarch64.rpm cups-libs-2.4.0-7.u2.fos23.aarch64.rpm cups-lpd-2.4.0-7.u2.fos23.aarch64.rpm cups-ipptool-2.4.0-7.u2.fos23.aarch64.rpm cups-printerapp-2.4.0-7.u2.fos23.aarch64.rpm FusionOS-SA-2023-2119 Important FusionOS CVE-2023-24805:cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. If you use the Backend Error Handler (beh) to create an accessible network printer, this security vulnerability can cause remote code execution. `beh.c` contains the line `retval = system(cmdline) >> 8;` which calls the `system` command with the operand `cmdline`. `cmdline` contains multiple user controlled, unsanitized values. As a result an attacker with network access to the hosted print server can exploit this vulnerability to inject system commands which are executed in the context of the running server. FusionOS cups-filters-1.28.9-3.u1.fos23.x86_64.rpm cups-filters-devel-1.28.9-3.u1.fos23.x86_64.rpm cups-filters-help-1.28.9-3.u1.fos23.noarch.rpm cups-filters-1.28.9-3.u1.fos23.aarch64.rpm cups-filters-devel-1.28.9-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2120 Moderate FusionOS CVE-2023-28322:An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST. CVE-2023-28320:A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave. CVE-2023-28321:An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`. FusionOS curl-7.79.1-19.u9.fos23.x86_64.rpm libcurl-7.79.1-19.u9.fos23.x86_64.rpm libcurl-devel-7.79.1-19.u9.fos23.x86_64.rpm curl-help-7.79.1-19.u9.fos23.noarch.rpm curl-7.79.1-19.u9.fos23.aarch64.rpm libcurl-7.79.1-19.u9.fos23.aarch64.rpm libcurl-devel-7.79.1-19.u9.fos23.aarch64.rpm FusionOS-SA-2023-2121 Critical FusionOS CVE-2023-28879:In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written. FusionOS ghostscript-9.55.0-2.u1.fos23.x86_64.rpm ghostscript-devel-9.55.0-2.u1.fos23.x86_64.rpm ghostscript-help-9.55.0-2.u1.fos23.noarch.rpm ghostscript-tools-dvipdf-9.55.0-2.u1.fos23.x86_64.rpm ghostscript-9.55.0-2.u1.fos23.aarch64.rpm ghostscript-devel-9.55.0-2.u1.fos23.aarch64.rpm ghostscript-tools-dvipdf-9.55.0-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2122 Important FusionOS CVE-2022-42003:In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. CVE-2022-42004:In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization. CVE-2020-36518:jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. FusionOS jackson-databind-2.9.8-9.u3.fos23.noarch.rpm jackson-databind-javadoc-2.9.8-9.u3.fos23.noarch.rpm FusionOS-SA-2023-2123 Important FusionOS CVE-2023-21930:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21954:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21967:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. FusionOS java-1.8.0-openjdk-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-headless-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-headless-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-devel-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-devel-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-demo-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-demo-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-src-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-src-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-javadoc-1.8.0.372.b07-0.u1.fos23.noarch.rpm java-1.8.0-openjdk-javadoc-zip-1.8.0.372.b07-0.u1.fos23.noarch.rpm java-1.8.0-openjdk-accessibility-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-devel-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-headless-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-headless-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-devel-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-devel-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-demo-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-demo-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-src-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-src-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-accessibility-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-devel-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm FusionOS-SA-2023-2124 Important FusionOS CVE-2023-21930:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21967:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. FusionOS java-11-openjdk-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-slowdebug-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-headless-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-headless-slowdebug-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-devel-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-devel-slowdebug-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-jmods-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-jmods-slowdebug-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-demo-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-demo-slowdebug-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-src-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-src-slowdebug-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-javadoc-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-javadoc-zip-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-slowdebug-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-headless-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-headless-slowdebug-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-devel-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-devel-slowdebug-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-jmods-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-jmods-slowdebug-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-demo-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-demo-slowdebug-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-src-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-src-slowdebug-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-javadoc-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-javadoc-zip-11.0.19.7-0.fos23.aarch64.rpm FusionOS-SA-2023-2125 Important FusionOS CVE-2023-21930:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21967:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. FusionOS java-17-openjdk-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-slowdebug-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-headless-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-headless-slowdebug-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-devel-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-devel-slowdebug-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-jmods-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-jmods-slowdebug-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-demo-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-demo-slowdebug-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-src-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-src-slowdebug-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-javadoc-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-javadoc-zip-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-slowdebug-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-headless-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-headless-slowdebug-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-devel-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-devel-slowdebug-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-jmods-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-jmods-slowdebug-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-demo-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-demo-slowdebug-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-src-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-src-slowdebug-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-javadoc-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-javadoc-zip-17.0.5.8-0.u1.fos23.aarch64.rpm FusionOS-SA-2023-2126 Important FusionOS CVE-2022-45685:A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data. CVE-2022-45693:Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string. CVE-2022-40149:Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack. FusionOS jettison-1.3.7-1.u2.fos23.noarch.rpm jettison-javadoc-1.3.7-1.u2.fos23.noarch.rpm FusionOS-SA-2023-2127 Important FusionOS CVE-2023-3141:A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak. CVE-2023-22998:In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer). CVE-2023-34256:An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. CVE-2022-48502:An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c. CVE-2023-25012:The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED controllers remain registered for too long. CVE-2023-2985:A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause a denial of service problem. CVE-2023-3111:A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag(). CVE-2023-32233:In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled. CVE-2022-1015:A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue. CVE-2023-32233:In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled. CVE-2023-2124:An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system. CVE-2023-32269:An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-after-free because accept is also allowed for a successfully connected AF_NETROM socket. However, in order for an attacker to exploit this, the system must have netrom routing configured or the attacker must have the CAP_NET_ADMIN capability. CVE-2023-2002:A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication. CVE-2023-26544:In the Linux kernel 6.0.8, there is a use-after-free in run_unpack in fs/ntfs3/run.c, related to a difference between NTFS sector size and media sector size. CVE-2023-0459:Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_ok" check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak information. FusionOS kernel-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm kernel-headers-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm kernel-devel-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm kernel-tools-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm perf-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm python3-perf-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm bpftool-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm kernel-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm kernel-headers-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm kernel-devel-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm kernel-tools-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm perf-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm python3-perf-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm bpftool-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm FusionOS-SA-2023-2128 Low FusionOS CVE-2023-2602:A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory. CVE-2023-2603:A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4GiB. FusionOS libcap-2.61-5.u1.fos23.x86_64.rpm libcap-devel-2.61-5.u1.fos23.x86_64.rpm libcap-help-2.61-5.u1.fos23.noarch.rpm libcap-2.61-5.u1.fos23.aarch64.rpm libcap-devel-2.61-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2129 Important FusionOS CVE-2023-30570:pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets. The earliest affected version is 3.28. FusionOS libreswan-4.11-1.u1.fos23.x86_64.rpm libreswan-help-4.11-1.u1.fos23.x86_64.rpm libreswan-4.11-1.u1.fos23.aarch64.rpm libreswan-help-4.11-1.u1.fos23.aarch64.rpm FusionOS-SA-2023-2130 Moderate FusionOS CVE-2023-1667:A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service. CVE-2023-2283:A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK. FusionOS libssh-0.9.6-7.u2.fos23.x86_64.rpm libssh-devel-0.9.6-7.u2.fos23.x86_64.rpm libssh-help-0.9.6-7.u2.fos23.noarch.rpm libssh-0.9.6-7.u2.fos23.aarch64.rpm libssh-devel-0.9.6-7.u2.fos23.aarch64.rpm FusionOS-SA-2023-2131 Moderate FusionOS CVE-2023-1916:A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x. CVE-2023-2731:A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attacker to craft specific input data that can cause the program to dereference a NULL pointer when decompressing a TIFF format file, resulting in a program crash or denial of service. FusionOS libtiff-4.3.0-25.u4.fos23.x86_64.rpm libtiff-devel-4.3.0-25.u4.fos23.x86_64.rpm libtiff-static-4.3.0-25.u4.fos23.x86_64.rpm libtiff-tools-4.3.0-25.u4.fos23.x86_64.rpm libtiff-help-4.3.0-25.u4.fos23.noarch.rpm libtiff-4.3.0-25.u4.fos23.aarch64.rpm libtiff-devel-4.3.0-25.u4.fos23.aarch64.rpm libtiff-static-4.3.0-25.u4.fos23.aarch64.rpm libtiff-tools-4.3.0-25.u4.fos23.aarch64.rpm FusionOS-SA-2023-2132 Important FusionOS CVE-2023-1017:An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context. CVE-2023-1018:An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can read or access sensitive data stored in the TPM. FusionOS libtpms-0.7.3-8.u1.fos23.x86_64.rpm libtpms-devel-0.7.3-8.u1.fos23.x86_64.rpm libtpms-0.7.3-8.u1.fos23.aarch64.rpm libtpms-devel-0.7.3-8.u1.fos23.aarch64.rpm FusionOS-SA-2023-2133 Moderate FusionOS CVE-2023-1999:There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free. FusionOS libwebp-1.2.1-3.u1.fos23.x86_64.rpm libwebp-tools-1.2.1-3.u1.fos23.x86_64.rpm libwebp-devel-1.2.1-3.u1.fos23.x86_64.rpm libwebp-java-1.2.1-3.u1.fos23.x86_64.rpm libwebp-help-1.2.1-3.u1.fos23.noarch.rpm libwebp-1.2.1-3.u1.fos23.aarch64.rpm libwebp-tools-1.2.1-3.u1.fos23.aarch64.rpm libwebp-devel-1.2.1-3.u1.fos23.aarch64.rpm libwebp-java-1.2.1-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2134 Critical FusionOS CVE-2018-16487:A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype. CVE-2018-3721:lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects. CVE-2019-10744:Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload. CVE-2020-8203:Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20. FusionOS lodash-3.10.1-1.u1.fos23.noarch.rpm js-lodash-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-compat-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-node-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-cli-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-add-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-after-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-arraycopy-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-arrayeach-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-arrayevery-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-arrayfilter-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-arraymap-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-ary-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-assign-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-at-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-attempt-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseassign-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseat-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basecallback-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseclone-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basecompareascending-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basecopy-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basecreate-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basedelay-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basedifference-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseeach-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseeachright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basefilter-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basefind-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basefindindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseflatten-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basefor-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseforright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basefunctions-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseget-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseindexof-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseisequal-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseismatch-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basematches-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basematchesproperty-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basepullat-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baserandom-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basereduce-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseslice-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basesortby-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basesortbyorder-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basetostring-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseuniq-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basevalues-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-before-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-binaryindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-binaryindexby-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-bind-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-bindall-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-bindcallback-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-bindkey-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-cacheindexof-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-callback-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-camelcase-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-capitalize-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-ceil-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-charsleftindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-charsrightindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-chunk-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-clone-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-clonedeep-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-compact-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-constant-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-countby-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-create-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-createaggregator-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-createassigner-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-createcache-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-createcompounder-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-createpadding-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-createwrapper-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-curry-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-curryright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-debounce-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-deburr-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-defaults-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-defaultsdeep-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-defer-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-delay-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-difference-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-drop-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-dropright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-droprightwhile-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-dropwhile-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-endswith-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-escape-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-escaperegexp-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-every-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-fill-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-filter-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-find-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-findindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-findkey-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-findlast-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-findlastindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-findlastkey-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-findwhere-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-first-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-flatten-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-flattendeep-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-floor-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-flow-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-flowright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-foreach-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-foreachright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-forin-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-forinright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-forown-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-forownright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-functions-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-get-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-getnative-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-groupby-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-gt-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-gte-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-has-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-identity-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-includes-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-indexby-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-indexof-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-initial-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-inrange-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-intersection-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-invert-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-invoke-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-invokepath-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isarguments-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isarray-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isboolean-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isdate-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-iselement-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isempty-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isequal-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-iserror-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isfinite-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isfunction-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isiterateecall-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-ismatch-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isnan-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isnative-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isnull-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isnumber-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isobject-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isplainobject-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isregexp-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isstring-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-istypedarray-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isundefined-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-kebabcase-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-keys-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-keysin-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-last-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-lastindexof-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-lt-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-lte-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-map-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-mapkeys-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-mapvalues-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-matches-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-matchesproperty-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-max-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-memoize-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-merge-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-method-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-methodof-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-min-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-mixin-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-modargs-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-negate-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-noop-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-now-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-omit-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-once-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pad-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-padleft-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-padright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pairs-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-parseint-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-partial-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-partialright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-partition-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pick-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pickbyarray-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pickbycallback-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pluck-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-property-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-propertyof-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pull-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pullat-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-random-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-range-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-rearg-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-reduce-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-reduceright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-reescape-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-reevaluate-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-reinterpolate-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-reject-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-remove-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-repeat-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-replaceholders-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-rest-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-restparam-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-result-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-round-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-sample-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-set-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-shuffle-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-size-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-slice-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-snakecase-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-some-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-sortby-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-sortbyall-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-sortbyorder-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-sortedindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-sortedlastindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-spread-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-startcase-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-startswith-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-sum-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-support-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-take-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-takeright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-takerightwhile-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-takewhile-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-template-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-templatesettings-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-throttle-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-times-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-toarray-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-toiterable-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-topath-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-toplainobject-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-transform-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-trim-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-trimleft-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-trimmedleftindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-trimmedrightindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-trimright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-trunc-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-unescape-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-union-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-uniq-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-uniqueid-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-unzip-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-unzipwith-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-values-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-valuesin-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-where-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-without-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-words-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-wrap-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-xor-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-zip-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-zipobject-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-zipwith-3.10.1-1.u1.fos23.noarch.rpm FusionOS-SA-2023-2135 Low FusionOS CVE-2022-47952:lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because "Failed to open" often indicates that a file does not exist, whereas "does not refer to a network namespace path" often indicates that a file exists. NOTE: this is different from CVE-2018-6556 because the CVE-2018-6556 fix design was based on the premise that "we will report back to the user that the open() failed but the user has no way of knowing why it failed"; however, in many realistic cases, there are no plausible reasons for failing except that the file does not exist. FusionOS lxc-4.0.3-2022102419.u6.fos23.x86_64.rpm lxc-libs-4.0.3-2022102419.u6.fos23.x86_64.rpm lxc-devel-4.0.3-2022102419.u6.fos23.x86_64.rpm lxc-help-4.0.3-2022102419.u6.fos23.noarch.rpm lxc-4.0.3-2022102419.u6.fos23.aarch64.rpm lxc-libs-4.0.3-2022102419.u6.fos23.aarch64.rpm lxc-devel-4.0.3-2022102419.u6.fos23.aarch64.rpm FusionOS-SA-2023-2136 Important FusionOS CVE-2019-16869:Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling. FusionOS netty3-3.10.6-6.u1.fos23.noarch.rpm FusionOS-SA-2023-2137 Moderate FusionOS CVE-2023-26551:mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. CVE-2023-26552:mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. CVE-2023-26553:mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. CVE-2023-26554:mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. CVE-2023-26555:praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method would be complex, e.g., with a manipulated GPS receiver. CVE-2023-26551:mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. FusionOS ntp-4.2.8p15-10.u2.fos23.x86_64.rpm ntp-perl-4.2.8p15-10.u2.fos23.noarch.rpm ntp-help-4.2.8p15-10.u2.fos23.noarch.rpm ntp-4.2.8p15-10.u2.fos23.aarch64.rpm FusionOS-SA-2023-2138 Important FusionOS CVE-2023-2953:A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function. FusionOS openldap-2.6.0-6.u2.fos23.x86_64.rpm openldap-devel-2.6.0-6.u2.fos23.x86_64.rpm openldap-servers-2.6.0-6.u2.fos23.x86_64.rpm openldap-clients-2.6.0-6.u2.fos23.x86_64.rpm openldap-help-2.6.0-6.u2.fos23.noarch.rpm openldap-2.6.0-6.u2.fos23.aarch64.rpm openldap-devel-2.6.0-6.u2.fos23.aarch64.rpm openldap-servers-2.6.0-6.u2.fos23.aarch64.rpm openldap-clients-2.6.0-6.u2.fos23.aarch64.rpm FusionOS-SA-2023-2139 Important FusionOS CVE-2023-2650:Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(n^2) with 'n' being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature. The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer's certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low. FusionOS openssl-1.1.1m-22.u7.fos23.x86_64.rpm openssl-libs-1.1.1m-22.u7.fos23.x86_64.rpm openssl-perl-1.1.1m-22.u7.fos23.x86_64.rpm openssl-devel-1.1.1m-22.u7.fos23.x86_64.rpm openssl-help-1.1.1m-22.u7.fos23.noarch.rpm openssl-1.1.1m-22.u7.fos23.aarch64.rpm openssl-libs-1.1.1m-22.u7.fos23.aarch64.rpm openssl-perl-1.1.1m-22.u7.fos23.aarch64.rpm openssl-devel-1.1.1m-22.u7.fos23.aarch64.rpm FusionOS-SA-2023-2140 Important FusionOS CVE-2023-30861:Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met. 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets `session.permanent = True` 3. The application does not access or modify the session at any point during a request. 4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default). 5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. FusionOS python3-flask-2.1.2-4.u1.fos23.noarch.rpm FusionOS-SA-2023-2141 Moderate FusionOS CVE-2023-33733:Cross Site Scripting (XSS) in the New Policy form in Microworld Technologies eScan management console 14.0.1400.2281 allows a remote attacker to inject arbitrary code via the vulnerable parameters type, txtPolicyType, and Deletefileval. FusionOS python3-reportlab-3.6.10-1.u1.fos23.x86_64.rpm python-reportlab-help-3.6.10-1.u1.fos23.noarch.rpm python3-reportlab-3.6.10-1.u1.fos23.aarch64.rpm FusionOS-SA-2023-2142 Moderate FusionOS CVE-2023-32681:Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. FusionOS python3-requests-2.26.0-8.u2.fos23.noarch.rpm python-requests-help-2.26.0-8.u2.fos23.noarch.rpm FusionOS-SA-2023-2143 Important FusionOS CVE-2023-32762:An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match. ,CVE-2023-32763:An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. When a SVG file with an image inside it is rendered, a QTextLayout buffer overflow can be triggered. CVE-2023-24607:Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3. FusionOS qt5-qtbase-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-common-5.15.2-6.u2.fos23.noarch.rpm qt5-qtbase-devel-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-private-devel-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-examples-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-static-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-mysql-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-odbc-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-postgresql-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-gui-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-devel-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-private-devel-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-examples-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-static-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-mysql-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-odbc-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-postgresql-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-gui-5.15.2-6.u2.fos23.aarch64.rpm FusionOS-SA-2023-2144 Moderate FusionOS CVE-2023-28856:Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue. FusionOS redis5-5.0.7-5.u2.fos23.x86_64.rpm redis5-devel-5.0.7-5.u2.fos23.x86_64.rpm redis5-doc-5.0.7-5.u2.fos23.noarch.rpm redis5-5.0.7-5.u2.fos23.aarch64.rpm redis5-devel-5.0.7-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2145 Moderate FusionOS CVE-2023-28856:Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue. FusionOS redis6-6.2.7-2.u2.fos23.x86_64.rpm redis6-devel-6.2.7-2.u2.fos23.x86_64.rpm redis6-doc-6.2.7-2.u2.fos23.noarch.rpm redis6-6.2.7-2.u2.fos23.aarch64.rpm redis6-devel-6.2.7-2.u2.fos23.aarch64.rpm FusionOS-SA-2023-2146 Moderate FusionOS CVE-2018-14628:An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store. FusionOS samba-4.17.5-3.u2.fos23.x86_64.rpm samba-libs-4.17.5-3.u2.fos23.x86_64.rpm samba-client-4.17.5-3.u2.fos23.x86_64.rpm samba-common-4.17.5-3.u2.fos23.x86_64.rpm samba-common-tools-4.17.5-3.u2.fos23.x86_64.rpm samba-dc-4.17.5-3.u2.fos23.x86_64.rpm samba-dc-provision-4.17.5-3.u2.fos23.x86_64.rpm samba-dc-bind-dlz-4.17.5-3.u2.fos23.x86_64.rpm samba-devel-4.17.5-3.u2.fos23.x86_64.rpm samba-vfs-glusterfs-4.17.5-3.u2.fos23.x86_64.rpm samba-krb5-printing-4.17.5-3.u2.fos23.x86_64.rpm libsmbclient-4.17.5-3.u2.fos23.x86_64.rpm libsmbclient-devel-4.17.5-3.u2.fos23.x86_64.rpm libwbclient-4.17.5-3.u2.fos23.x86_64.rpm libwbclient-devel-4.17.5-3.u2.fos23.x86_64.rpm python3-samba-4.17.5-3.u2.fos23.x86_64.rpm python3-samba-test-4.17.5-3.u2.fos23.x86_64.rpm python3-samba-dc-4.17.5-3.u2.fos23.x86_64.rpm samba-pidl-4.17.5-3.u2.fos23.noarch.rpm samba-test-4.17.5-3.u2.fos23.x86_64.rpm samba-usershares-4.17.5-3.u2.fos23.x86_64.rpm samba-winbind-4.17.5-3.u2.fos23.x86_64.rpm samba-winbind-clients-4.17.5-3.u2.fos23.x86_64.rpm samba-winbind-krb5-locator-4.17.5-3.u2.fos23.x86_64.rpm samba-winbind-modules-4.17.5-3.u2.fos23.x86_64.rpm ctdb-4.17.5-3.u2.fos23.x86_64.rpm samba-help-4.17.5-3.u2.fos23.x86_64.rpm samba-4.17.5-3.u2.fos23.aarch64.rpm samba-libs-4.17.5-3.u2.fos23.aarch64.rpm samba-client-4.17.5-3.u2.fos23.aarch64.rpm samba-common-4.17.5-3.u2.fos23.aarch64.rpm samba-common-tools-4.17.5-3.u2.fos23.aarch64.rpm samba-dc-4.17.5-3.u2.fos23.aarch64.rpm samba-dc-provision-4.17.5-3.u2.fos23.aarch64.rpm samba-dc-bind-dlz-4.17.5-3.u2.fos23.aarch64.rpm samba-devel-4.17.5-3.u2.fos23.aarch64.rpm samba-krb5-printing-4.17.5-3.u2.fos23.aarch64.rpm libsmbclient-4.17.5-3.u2.fos23.aarch64.rpm libsmbclient-devel-4.17.5-3.u2.fos23.aarch64.rpm libwbclient-4.17.5-3.u2.fos23.aarch64.rpm libwbclient-devel-4.17.5-3.u2.fos23.aarch64.rpm python3-samba-4.17.5-3.u2.fos23.aarch64.rpm python3-samba-test-4.17.5-3.u2.fos23.aarch64.rpm python3-samba-dc-4.17.5-3.u2.fos23.aarch64.rpm samba-test-4.17.5-3.u2.fos23.aarch64.rpm samba-usershares-4.17.5-3.u2.fos23.aarch64.rpm samba-winbind-4.17.5-3.u2.fos23.aarch64.rpm samba-winbind-clients-4.17.5-3.u2.fos23.aarch64.rpm samba-winbind-krb5-locator-4.17.5-3.u2.fos23.aarch64.rpm samba-winbind-modules-4.17.5-3.u2.fos23.aarch64.rpm ctdb-4.17.5-3.u2.fos23.aarch64.rpm samba-help-4.17.5-3.u2.fos23.aarch64.rpm FusionOS-SA-2023-2147 Important FusionOS CVE-2023-33204:sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c. NOTE: this issue exists because of an incomplete fix for CVE-2022-39377. FusionOS sysstat-12.5.4-8.u2.fos23.x86_64.rpm sysstat-12.5.4-8.u2.fos23.aarch64.rpm FusionOS-SA-2023-2148 Moderate FusionOS CVE-2022-0563:A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4. FusionOS util-linux-2.37.2-19.u6.fos23.x86_64.rpm libfdisk-2.37.2-19.u6.fos23.x86_64.rpm libsmartcols-2.37.2-19.u6.fos23.x86_64.rpm libmount-2.37.2-19.u6.fos23.x86_64.rpm libblkid-2.37.2-19.u6.fos23.x86_64.rpm uuidd-2.37.2-19.u6.fos23.x86_64.rpm libuuid-2.37.2-19.u6.fos23.x86_64.rpm util-linux-user-2.37.2-19.u6.fos23.x86_64.rpm python3-libmount-2.37.2-19.u6.fos23.x86_64.rpm util-linux-devel-2.37.2-19.u6.fos23.x86_64.rpm util-linux-help-2.37.2-19.u6.fos23.noarch.rpm util-linux-2.37.2-19.u6.fos23.aarch64.rpm libfdisk-2.37.2-19.u6.fos23.aarch64.rpm libsmartcols-2.37.2-19.u6.fos23.aarch64.rpm libmount-2.37.2-19.u6.fos23.aarch64.rpm libblkid-2.37.2-19.u6.fos23.aarch64.rpm uuidd-2.37.2-19.u6.fos23.aarch64.rpm libuuid-2.37.2-19.u6.fos23.aarch64.rpm util-linux-user-2.37.2-19.u6.fos23.aarch64.rpm python3-libmount-2.37.2-19.u6.fos23.aarch64.rpm util-linux-devel-2.37.2-19.u6.fos23.aarch64.rpm FusionOS-SA-2023-2149 Important FusionOS CVE-2023-2609:NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. CVE-2023-2610:Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. FusionOS vim-common-9.0-15.u8.fos23.x86_64.rpm vim-minimal-9.0-15.u8.fos23.x86_64.rpm vim-enhanced-9.0-15.u8.fos23.x86_64.rpm vim-filesystem-9.0-15.u8.fos23.noarch.rpm vim-X11-9.0-15.u8.fos23.x86_64.rpm vim-common-9.0-15.u8.fos23.aarch64.rpm vim-minimal-9.0-15.u8.fos23.aarch64.rpm vim-enhanced-9.0-15.u8.fos23.aarch64.rpm vim-X11-9.0-15.u8.fos23.aarch64.rpm FusionOS-SA-2023-2150 Important FusionOS CVE-2023-28204:A flaw was found in the webkitgtk package. An out of bounds read may be possible when processing malicious web content, which can lead to information disclosure. CVE-2023-32373:A use after free vulnerability was found in the webkitgtk package. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2023-32409:A flaw was found in the WebGPU, part of the Webkit project. This flaw allows a remote attacker to break out of the Web Content sandbox. FusionOS webkit2gtk3-2.36.3-4.u1.fos23.x86_64.rpm webkit2gtk3-devel-2.36.3-4.u1.fos23.x86_64.rpm webkit2gtk3-jsc-2.36.3-4.u1.fos23.x86_64.rpm webkit2gtk3-jsc-devel-2.36.3-4.u1.fos23.x86_64.rpm webkit2gtk3-2.36.3-4.u1.fos23.aarch64.rpm webkit2gtk3-devel-2.36.3-4.u1.fos23.aarch64.rpm webkit2gtk3-jsc-2.36.3-4.u1.fos23.aarch64.rpm webkit2gtk3-jsc-devel-2.36.3-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2151 Important FusionOS CVE-2023-0668:Due to failure in validating the length provided by an attacker-crafted IEEE-C37.118 packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark. CVE-2023-2855:Candump log parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file CVE-2023-2856:VMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file CVE-2023-2857:BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file CVE-2023-2858:NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file CVE-2023-2879:GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file FusionOS wireshark-3.6.11-4.u3.fos23.x86_64.rpm wireshark-devel-3.6.11-4.u3.fos23.x86_64.rpm wireshark-help-3.6.11-4.u3.fos23.x86_64.rpm wireshark-3.6.11-4.u3.fos23.aarch64.rpm wireshark-devel-3.6.11-4.u3.fos23.aarch64.rpm wireshark-help-3.6.11-4.u3.fos23.aarch64.rpm FusionOS-SA-2023-2152 Important FusionOS CVE-2022-3550:A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. FusionOS xorg-x11-server-1.20.11-20.u7.fos23.x86_64.rpm xorg-x11-server-common-1.20.11-20.u7.fos23.x86_64.rpm xorg-x11-server-Xnest-1.20.11-20.u7.fos23.x86_64.rpm xorg-x11-server-Xdmx-1.20.11-20.u7.fos23.x86_64.rpm xorg-x11-server-Xvfb-1.20.11-20.u7.fos23.x86_64.rpm xorg-x11-server-Xephyr-1.20.11-20.u7.fos23.x86_64.rpm xorg-x11-server-devel-1.20.11-20.u7.fos23.x86_64.rpm xorg-x11-server-help-1.20.11-20.u7.fos23.noarch.rpm xorg-x11-server-source-1.20.11-20.u7.fos23.noarch.rpm xorg-x11-server-1.20.11-20.u7.fos23.aarch64.rpm xorg-x11-server-common-1.20.11-20.u7.fos23.aarch64.rpm xorg-x11-server-Xnest-1.20.11-20.u7.fos23.aarch64.rpm xorg-x11-server-Xdmx-1.20.11-20.u7.fos23.aarch64.rpm xorg-x11-server-Xvfb-1.20.11-20.u7.fos23.aarch64.rpm xorg-x11-server-Xephyr-1.20.11-20.u7.fos23.aarch64.rpm xorg-x11-server-devel-1.20.11-20.u7.fos23.aarch64.rpm FusionOS-SA-2023-2153 Critical FusionOS CVE-2021-33454:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr_get_intnum() in libyasm/expr.c. CVE-2021-33455:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in do_directive() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33456:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in hash() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33457:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmac_params() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33458:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in find_cc() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33459:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in nasm_parser_directive() in modules/parsers/nasm/nasm-parse.c. CVE-2021-33460:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in if_condition() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33461:An issue was discovered in yasm version 1.3.0. There is a use-after-free in yasm_intnum_destroy() in libyasm/intnum.c. CVE-2021-33462:An issue was discovered in yasm version 1.3.0. There is a use-after-free in expr_traverse_nodes_post() in libyasm/expr.c. CVE-2021-33463:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr__copy_except() in libyasm/expr.c. CVE-2021-33464:An issue was discovered in yasm version 1.3.0. There is a heap-buffer-overflow in inc_fopen() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33465:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmacro() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33466:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_smacro() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33467:An issue was discovered in yasm version 1.3.0. There is a use-after-free in pp_getline() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33468:An issue was discovered in yasm version 1.3.0. There is a use-after-free in error() in modules/preprocs/nasm/nasm-pp.c. CVE-2023-30402:yasm v1.3.0 was discovered to contain a heap overflow via the function handle_dot_label at /nasm/nasm-token.re CVE-2023-31972:yasm v1.3.0 was discovered to contain a use after free via the function pp_getline at /nasm/nasm-pp.c. CVE-2023-31973:yasm v1.3.0 was discovered to contain a use after free via the function expand_mmac_params at /nasm/nasm-pp.c. CVE-2023-31974:yasm v1.3.0 was discovered to contain a use after free via the function error at /nasm/nasm-pp.c. CVE-2023-31975:yasm v1.3.0 was discovered to contain a memory leak via the function yasm_intnum_copy at /libyasm/intnum.c. FusionOS yasm-1.3.0-10.u1.fos23.x86_64.rpm yasm-1.3.0-10.u1.fos23.aarch64.rpm FusionOS-SA-2023-2154 Important FusionOS CVE-2022-35737:SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. FusionOS perl-DBD-SQLite-1.70-2.u1.fos23.x86_64.rpm perl-DBD-SQLite-help-1.70-2.u1.fos23.x86_64.rpm perl-DBD-SQLite-1.70-2.u1.fos23.aarch64.rpm perl-DBD-SQLite-help-1.70-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2155 Important FusionOS CVE-2021-23840:Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). FusionOS shim-15.6-9.u6.fos23.x86_64.rpm shim-15.6-9.u6.fos23.aarch64.rpm FusionOS-SA-2023-2156 Critical FusionOS CVE-2016-9840:inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. CVE-2016-9841:inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. CVE-2016-9842:The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers. CVE-2016-9843:The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation. FusionOS syslinux-6.04-13.u1.fos23.x86_64.rpm syslinux-perl-6.04-13.u1.fos23.x86_64.rpm syslinux-devel-6.04-13.u1.fos23.x86_64.rpm syslinux-extlinux-6.04-13.u1.fos23.x86_64.rpm syslinux-tftpboot-6.04-13.u1.fos23.noarch.rpm syslinux-extlinux-nonlinux-6.04-13.u1.fos23.noarch.rpm syslinux-nonlinux-6.04-13.u1.fos23.noarch.rpm syslinux-efi64-6.04-13.u1.fos23.x86_64.rpm FusionOS-SA-2023-2157 Important FusionOS CVE-2023-2911:If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named` to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33 through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1. CVE-2023-2828:Every named instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the max-cache-size statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets from the cache, to keep memory use below the configured limit.It has been discovered that the effectiveness of the cache-cleaning algorithm used in named can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured max-cache-size limit to be significantly exceeded.This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0 through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1. FusionOS bind-9.16.23-18.u5.fos23.x86_64.rpm bind-pkcs11-9.16.23-18.u5.fos23.x86_64.rpm bind-pkcs11-utils-9.16.23-18.u5.fos23.x86_64.rpm bind-pkcs11-libs-9.16.23-18.u5.fos23.x86_64.rpm bind-pkcs11-devel-9.16.23-18.u5.fos23.x86_64.rpm bind-libs-9.16.23-18.u5.fos23.x86_64.rpm bind-license-9.16.23-18.u5.fos23.noarch.rpm bind-utils-9.16.23-18.u5.fos23.x86_64.rpm bind-dnssec-utils-9.16.23-18.u5.fos23.x86_64.rpm bind-dnssec-doc-9.16.23-18.u5.fos23.noarch.rpm bind-devel-9.16.23-18.u5.fos23.x86_64.rpm bind-chroot-9.16.23-18.u5.fos23.x86_64.rpm python3-bind-9.16.23-18.u5.fos23.noarch.rpm bind-9.16.23-18.u5.fos23.aarch64.rpm bind-pkcs11-9.16.23-18.u5.fos23.aarch64.rpm bind-pkcs11-utils-9.16.23-18.u5.fos23.aarch64.rpm bind-pkcs11-libs-9.16.23-18.u5.fos23.aarch64.rpm bind-pkcs11-devel-9.16.23-18.u5.fos23.aarch64.rpm bind-libs-9.16.23-18.u5.fos23.aarch64.rpm bind-utils-9.16.23-18.u5.fos23.aarch64.rpm bind-dnssec-utils-9.16.23-18.u5.fos23.aarch64.rpm bind-devel-9.16.23-18.u5.fos23.aarch64.rpm bind-chroot-9.16.23-18.u5.fos23.aarch64.rpm FusionOS-SA-2023-2158 Moderate FusionOS CVE-2023-33201:Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability. FusionOS bouncycastle-1.67-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2159 Important FusionOS CVE-2023-34241:OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process. The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is warn or higher and in two scenarios: there is a double-lookup for the IP Address (HostNameLookups Double is set in `cupsd.conf`) which fails to resolve, or if CUPS is compiled with TCP wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`. Version 2.4.6 has a patch for this issue. FusionOS cups-2.4.0-8.u3.fos23.x86_64.rpm cups-client-2.4.0-8.u3.fos23.x86_64.rpm cups-devel-2.4.0-8.u3.fos23.x86_64.rpm cups-libs-2.4.0-8.u3.fos23.x86_64.rpm cups-filesystem-2.4.0-8.u3.fos23.noarch.rpm cups-lpd-2.4.0-8.u3.fos23.x86_64.rpm cups-ipptool-2.4.0-8.u3.fos23.x86_64.rpm cups-printerapp-2.4.0-8.u3.fos23.x86_64.rpm cups-help-2.4.0-8.u3.fos23.noarch.rpm cups-2.4.0-8.u3.fos23.aarch64.rpm cups-client-2.4.0-8.u3.fos23.aarch64.rpm cups-devel-2.4.0-8.u3.fos23.aarch64.rpm cups-libs-2.4.0-8.u3.fos23.aarch64.rpm cups-lpd-2.4.0-8.u3.fos23.aarch64.rpm cups-ipptool-2.4.0-8.u3.fos23.aarch64.rpm cups-printerapp-2.4.0-8.u3.fos23.aarch64.rpm FusionOS-SA-2023-2160 Moderate FusionOS CVE-2022-4304:A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. FusionOS edk2-devel-202011-12.u3.fos23.x86_64.rpm python3-edk2-devel-202011-12.u3.fos23.noarch.rpm edk2-help-202011-12.u3.fos23.noarch.rpm edk2-ovmf-202011-12.u3.fos23.noarch.rpm edk2-devel-202011-12.u3.fos23.aarch64.rpm FusionOS-SA-2023-2161 Critical FusionOS CVE-2020-25969:gnuplot v5.5 was discovered to contain a buffer overflow via the function plotrequest(). FusionOS gnuplot-5.0.6-14.u1.fos23.x86_64.rpm gnuplot-help-5.0.6-14.u1.fos23.noarch.rpm gnuplot-5.0.6-14.u1.fos23.aarch64.rpm FusionOS-SA-2023-2162 Critical FusionOS CVE-2023-29402:The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via go get , are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected). CVE-2023-29403:On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers. CVE-2023-29404:he go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers. CVE-2023-29405:The go command may execute arbitrary code at build time when using cgo. This may occur when running go get on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler. FusionOS golang-1.20.5-1.u2.fos23.x86_64.rpm golang-help-1.20.5-1.u2.fos23.noarch.rpm golang-devel-1.20.5-1.u2.fos23.noarch.rpm golang-1.20.5-1.u2.fos23.aarch64.rpm FusionOS-SA-2023-2163 Important FusionOS CVE-2023-2976:Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class. Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows. FusionOS guava-25.0-6.u1.fos23.noarch.rpm guava-help-25.0-6.u1.fos23.noarch.rpm guava-testlib-25.0-6.u1.fos23.noarch.rpm FusionOS-SA-2023-2164 Important FusionOS CVE-2023-3389:A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer. CVE-2023-3090:A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation.The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. CVE-2023-3327:An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c. CVE-2023-35823:An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c. CVE-2023-35824:An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c. CVE-2023-3006:A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim s hardware context. Once that occurs, speculation caused by the mispredicted branches can cause cache allocation. This issue leads to obtaining information that should not be accessible. CVE-2023-31084:An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event, down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and down(&fepriv->sem) may block the process. CVE-2023-35828:An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c. CVE-2023-35788:An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation. CVE-2023-3358:A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system. CVE-2022-48502:An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c. CVE-2023-33288:An issue was discovered in the Linux kernel before 6.2.9. A use-after-free was found in bq24190_remove in drivers/power/supply/bq24190_charger.c. It could allow a local attacker to crash the system due to a race condition. CVE-2023-2985:A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause a denial of service problem. CVE-2023-3161:A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service. CVE-2023-3212:A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic. CVE-2023-3268:An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel internal information. CVE-2023-35829:An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec.c. CVE-2023-3141:A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak. FusionOS kernel-5.10.0-136.40.0.117.u69.fos23.x86_64.rpm kernel-headers-5.10.0-136.40.0.117.u69.fos23.x86_64.rpm kernel-devel-5.10.0-136.40.0.117.u69.fos23.x86_64.rpm kernel-tools-5.10.0-136.40.0.117.u69.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.40.0.117.u69.fos23.x86_64.rpm perf-5.10.0-136.40.0.117.u69.fos23.x86_64.rpm python3-perf-5.10.0-136.40.0.117.u69.fos23.x86_64.rpm bpftool-5.10.0-136.40.0.117.u69.fos23.x86_64.rpm kernel-5.10.0-136.40.0.117.u69.fos23.aarch64.rpm kernel-headers-5.10.0-136.40.0.117.u69.fos23.aarch64.rpm kernel-devel-5.10.0-136.40.0.117.u69.fos23.aarch64.rpm kernel-tools-5.10.0-136.40.0.117.u69.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.40.0.117.u69.fos23.aarch64.rpm perf-5.10.0-136.40.0.117.u69.fos23.aarch64.rpm python3-perf-5.10.0-136.40.0.117.u69.fos23.aarch64.rpm bpftool-5.10.0-136.40.0.117.u69.fos23.aarch64.rpm FusionOS-SA-2023-2165 Moderate FusionOS CVE-2023-35789:An issue was discovered in the C AMQP client library (aka rabbitmq-c) through 0.13.0 for RabbitMQ. Credentials can only be entered on the command line (e.g., for amqp-publish or amqp-consume) and are thus visible to local attackers by listing a process and its arguments. FusionOS librabbitmq-0.9.0-9.u1.fos23.x86_64.rpm librabbitmq-devel-0.9.0-9.u1.fos23.x86_64.rpm librabbitmq-help-0.9.0-9.u1.fos23.x86_64.rpm librabbitmq-0.9.0-9.u1.fos23.aarch64.rpm librabbitmq-devel-0.9.0-9.u1.fos23.aarch64.rpm librabbitmq-help-0.9.0-9.u1.fos23.aarch64.rpm FusionOS-SA-2023-2166 Moderate FusionOS CVE-2023-26965:loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image. CVE-2023-3316:A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones. CVE-2023-25433:libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage() in tiffcrop cause heap-buffer-overflow and SEGV. CVE-2023-26966:libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian. CVE-2023-2908:A null pointer dereference issue was found in Libtiff's tif_dir.c file. This issue may allow an attacker to pass a crafted TIFF image file to the tiffcp utility which triggers a runtime error that causes undefined behavior. This will result in an application crash, eventually leading to a denial of service. CVE-2023-3576:A vulnerability was found in libtiff where a memory leak exists in tools/tiffcrop.c FusionOS libtiff-4.3.0-29.u5.fos23.x86_64.rpm libtiff-devel-4.3.0-29.u5.fos23.x86_64.rpm libtiff-static-4.3.0-29.u5.fos23.x86_64.rpm libtiff-tools-4.3.0-29.u5.fos23.x86_64.rpm libtiff-help-4.3.0-29.u5.fos23.noarch.rpm libtiff-4.3.0-29.u5.fos23.aarch64.rpm libtiff-devel-4.3.0-29.u5.fos23.aarch64.rpm libtiff-static-4.3.0-29.u5.fos23.aarch64.rpm libtiff-tools-4.3.0-29.u5.fos23.aarch64.rpm FusionOS-SA-2023-2167 Important FusionOS CVE-2023-29491:curses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable. FusionOS ncurses-6.3-7.u2.fos23.x86_64.rpm ncurses-base-6.3-7.u2.fos23.noarch.rpm ncurses-libs-6.3-7.u2.fos23.x86_64.rpm ncurses-devel-6.3-7.u2.fos23.x86_64.rpm ncurses-compat-libs-6.3-7.u2.fos23.x86_64.rpm ncurses-static-6.3-7.u2.fos23.x86_64.rpm ncurses-help-6.3-7.u2.fos23.x86_64.rpm ncurses-6.3-7.u2.fos23.aarch64.rpm ncurses-libs-6.3-7.u2.fos23.aarch64.rpm ncurses-devel-6.3-7.u2.fos23.aarch64.rpm ncurses-compat-libs-6.3-7.u2.fos23.aarch64.rpm ncurses-static-6.3-7.u2.fos23.aarch64.rpm ncurses-help-6.3-7.u2.fos23.aarch64.rpm FusionOS-SA-2023-2168 Important FusionOS CVE-2022-4304:A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. CVE-2023-0465:Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. CVE-2023-0466:The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications. CVE-2023-0286:There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. FusionOS openresty-openssl111-asan-1.1.1h-2.u2.fos23.x86_64.rpm openresty-openssl111-asan-1.1.1h-2.u2.fos23.aarch64.rpm FusionOS-SA-2023-2169 Important FusionOS CVE-2023-31486:HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. FusionOS perl-HTTP-Tiny-0.080-2.u1.fos23.noarch.rpm perl-HTTP-Tiny-help-0.080-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2170 Moderate FusionOS CVE-2023-36617:A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version. FusionOS ruby-3.0.3-131.u3.fos23.x86_64.rpm ruby-devel-3.0.3-131.u3.fos23.x86_64.rpm rubygems-3.2.32-131.u3.fos23.noarch.rpm rubygems-devel-3.2.32-131.u3.fos23.noarch.rpm rubygem-rake-13.0.3-131.u3.fos23.noarch.rpm rubygem-rbs-1.4.0-131.u3.fos23.noarch.rpm ruby-irb-3.0.3-131.u3.fos23.noarch.rpm rubygem-rdoc-6.3.3-131.u3.fos23.noarch.rpm ruby-help-3.0.3-131.u3.fos23.noarch.rpm rubygem-bigdecimal-3.0.0-131.u3.fos23.x86_64.rpm rubygem-did_you_mean-1.5.0-131.u3.fos23.noarch.rpm rubygem-io-console-0.5.7-131.u3.fos23.x86_64.rpm rubygem-json-2.5.1-131.u3.fos23.x86_64.rpm rubygem-minitest-5.14.2-131.u3.fos23.noarch.rpm rubygem-openssl-2.2.1-131.u3.fos23.x86_64.rpm rubygem-power_assert-1.2.0-131.u3.fos23.noarch.rpm rubygem-psych-3.3.2-131.u3.fos23.x86_64.rpm rubygem-test-unit-3.3.7-131.u3.fos23.noarch.rpm rubygem-rexml-3.2.5-131.u3.fos23.noarch.rpm rubygem-rss-0.2.9-131.u3.fos23.noarch.rpm rubygem-typeprof-0.15.2-131.u3.fos23.noarch.rpm ruby-3.0.3-131.u3.fos23.aarch64.rpm ruby-devel-3.0.3-131.u3.fos23.aarch64.rpm rubygem-bigdecimal-3.0.0-131.u3.fos23.aarch64.rpm rubygem-io-console-0.5.7-131.u3.fos23.aarch64.rpm rubygem-json-2.5.1-131.u3.fos23.aarch64.rpm rubygem-openssl-2.2.1-131.u3.fos23.aarch64.rpm rubygem-psych-3.3.2-131.u3.fos23.aarch64.rpm FusionOS-SA-2023-2171 Important FusionOS CVE-2023-34454:snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing an unrecoverable fatal error. The function `compress(char[] input)` in the file `Snappy.java` receives an array of characters and compresses it. It does so by multiplying the length by 2 and passing it to the rawCompress` function. Since the length is not tested, the multiplication by two can cause an integer overflow and become negative. The rawCompress function then uses the received length and passes it to the natively compiled maxCompressedLength function, using the returned value to allocate a byte array. Since the maxCompressedLength function treats the length as an unsigned integer, it doesn’t care that it is negative, and it returns a valid value, which is casted to a signed integer by the Java engine. If the result is negative, a `java.lang.NegativeArraySizeException` exception will be raised while trying to allocate the array `buf`. On the other side, if the result is positive, the `buf` array will successfully be allocated, but its size might be too small to use for the compression, causing a fatal Access Violation error. The same issue exists also when using the `compress` functions that receive double, float, int, long and short, each using a different multiplier that may cause the same issue. The issue most likely won’t occur when using a byte array, since creating a byte array of size 0x80000000 (or any other negative value) is impossible in the first place. CVE-2023-34455:snappy-java is a fast compressor/decompressor for Java. Due to use of an unchecked chunk length, an unrecoverable fatal error can occur in versions prior to 1.1.10.1. The code in the function hasNextChunk in the fileSnappyInputStream.java checks if a given stream has more chunks to read. It does that by attempting to read 4 bytes. If it wasn’t possible to read the 4 bytes, the function returns false. Otherwise, if 4 bytes were available, the code treats them as the length of the next chunk. In the case that the `compressed` variable is null, a byte array is allocated with the size given by the input data. Since the code doesn’t test the legality of the `chunkSize` variable, it is possible to pass a negative number (such as 0xFFFFFFFF which is -1), which will cause the code to raise a `java.lang.NegativeArraySizeException` exception. A worse case would happen when passing a huge positive value (such as 0x7FFFFFFF), which would raise the fatal `java.lang.OutOfMemoryError` error. Version 1.1.10.1 contains a patch for this issue. FusionOS snappy-java-1.1.2.4-2.u1.fos23.x86_64.rpm snappy-java-javadoc-1.1.2.4-2.u1.fos23.noarch.rpm snappy-java-1.1.2.4-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2172 Moderate FusionOS CVE-2023-1672:A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host. FusionOS tang-7-3.u2.fos23.x86_64.rpm tang-help-7-3.u2.fos23.noarch.rpm tang-7-3.u2.fos23.aarch64.rpm FusionOS-SA-2023-2173 Important FusionOS CVE-2023-32700:LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5. FusionOS texlive-base-20180414-34.u1.fos23.x86_64.rpm texlive-a2ping-20180414-34.u1.fos23.noarch.rpm texlive-accfonts-20180414-34.u1.fos23.noarch.rpm texlive-adhocfilelist-20180414-34.u1.fos23.noarch.rpm texlive-afm2pl-20180414-34.u1.fos23.x86_64.rpm texlive-aleph-20180414-34.u1.fos23.x86_64.rpm texlive-amstex-20180414-34.u1.fos23.noarch.rpm texlive-arara-20180414-34.u1.fos23.noarch.rpm texlive-authorindex-20180414-34.u1.fos23.noarch.rpm texlive-autosp-20180414-34.u1.fos23.x86_64.rpm texlive-axodraw2-20180414-34.u1.fos23.x86_64.rpm texlive-bib2gls-20180414-34.u1.fos23.noarch.rpm texlive-bibexport-20180414-34.u1.fos23.noarch.rpm texlive-bibtex-20180414-34.u1.fos23.x86_64.rpm texlive-bibtexu-20180414-34.u1.fos23.x86_64.rpm texlive-bibtex8-20180414-34.u1.fos23.x86_64.rpm texlive-bundledoc-20180414-34.u1.fos23.noarch.rpm texlive-cachepic-20180414-34.u1.fos23.noarch.rpm texlive-checkcites-20180414-34.u1.fos23.noarch.rpm texlive-checklistings-20180414-34.u1.fos23.noarch.rpm texlive-chktex-20180414-34.u1.fos23.x86_64.rpm texlive-cjkutils-20180414-34.u1.fos23.x86_64.rpm texlive-context-20180414-34.u1.fos23.noarch.rpm texlive-convbkmk-20180414-34.u1.fos23.noarch.rpm texlive-crossrefware-20180414-34.u1.fos23.noarch.rpm texlive-cslatex-20180414-34.u1.fos23.noarch.rpm texlive-csplain-20180414-34.u1.fos23.noarch.rpm texlive-ctan-o-mat-20180414-34.u1.fos23.noarch.rpm texlive-ctanify-20180414-34.u1.fos23.noarch.rpm texlive-ctie-20180414-34.u1.fos23.x86_64.rpm texlive-cweb-20180414-34.u1.fos23.x86_64.rpm texlive-cyrillic-20180414-34.u1.fos23.noarch.rpm texlive-de-macro-20180414-34.u1.fos23.noarch.rpm texlive-detex-20180414-34.u1.fos23.x86_64.rpm texlive-diadia-20180414-34.u1.fos23.noarch.rpm texlive-dosepsbin-20180414-34.u1.fos23.noarch.rpm texlive-dtl-20180414-34.u1.fos23.x86_64.rpm texlive-dtxgen-20180414-34.u1.fos23.noarch.rpm texlive-dvi2tty-20180414-34.u1.fos23.x86_64.rpm texlive-dviasm-20180414-34.u1.fos23.noarch.rpm texlive-dvicopy-20180414-34.u1.fos23.x86_64.rpm texlive-dvidvi-20180414-34.u1.fos23.x86_64.rpm texlive-dviinfox-20180414-34.u1.fos23.noarch.rpm texlive-dviljk-20180414-34.u1.fos23.x86_64.rpm texlive-dvipdfmx-20180414-34.u1.fos23.x86_64.rpm texlive-dvipng-20180414-34.u1.fos23.x86_64.rpm texlive-dvipos-20180414-34.u1.fos23.x86_64.rpm texlive-dvips-20180414-34.u1.fos23.x86_64.rpm texlive-dvisvgm-20180414-34.u1.fos23.x86_64.rpm texlive-ebong-20180414-34.u1.fos23.noarch.rpm texlive-eplain-20180414-34.u1.fos23.noarch.rpm texlive-epspdf-20180414-34.u1.fos23.noarch.rpm texlive-epstopdf-20180414-34.u1.fos23.noarch.rpm texlive-fig4latex-20180414-34.u1.fos23.noarch.rpm texlive-findhyph-20180414-34.u1.fos23.noarch.rpm texlive-fontinst-20180414-34.u1.fos23.noarch.rpm texlive-fontools-20180414-34.u1.fos23.noarch.rpm texlive-fontware-20180414-34.u1.fos23.x86_64.rpm texlive-fragmaster-20180414-34.u1.fos23.noarch.rpm texlive-getmap-20180414-34.u1.fos23.noarch.rpm texlive-glossaries-20180414-34.u1.fos23.noarch.rpm texlive-glyphlist-20180414-34.u1.fos23.noarch.rpm texlive-gregoriotex-20180414-34.u1.fos23.x86_64.rpm texlive-gsftopk-20180414-34.u1.fos23.x86_64.rpm texlive-installfont-20180414-34.u1.fos23.noarch.rpm texlive-jadetex-20180414-34.u1.fos23.noarch.rpm texlive-jfmutil-20180414-34.u1.fos23.noarch.rpm texlive-kotex-utils-20180414-34.u1.fos23.noarch.rpm texlive-kpathsea-20180414-34.u1.fos23.x86_64.rpm texlive-l3build-20180414-34.u1.fos23.noarch.rpm texlive-lacheck-20180414-34.u1.fos23.x86_64.rpm texlive-latex-20180414-34.u1.fos23.noarch.rpm texlive-latex-git-log-20180414-34.u1.fos23.noarch.rpm texlive-latex-papersize-20180414-34.u1.fos23.noarch.rpm texlive-latex2man-20180414-34.u1.fos23.noarch.rpm texlive-latex2nemeth-20180414-34.u1.fos23.noarch.rpm texlive-latexdiff-20180414-34.u1.fos23.noarch.rpm texlive-latexfileversion-20180414-34.u1.fos23.noarch.rpm texlive-latexpand-20180414-34.u1.fos23.noarch.rpm texlive-lcdftypetools-20180414-34.u1.fos23.x86_64.rpm texlive-lib-20180414-34.u1.fos23.x86_64.rpm texlive-lib-devel-20180414-34.u1.fos23.x86_64.rpm texlive-lilyglyphs-20180414-34.u1.fos23.noarch.rpm texlive-listbib-20180414-34.u1.fos23.noarch.rpm texlive-listings-ext-20180414-34.u1.fos23.noarch.rpm texlive-lollipop-20180414-34.u1.fos23.noarch.rpm texlive-ltxfileinfo-20180414-34.u1.fos23.noarch.rpm texlive-ltximg-20180414-34.u1.fos23.noarch.rpm texlive-lua2dox-20180414-34.u1.fos23.noarch.rpm texlive-luaotfload-20180414-34.u1.fos23.noarch.rpm texlive-luatex-20180414-34.u1.fos23.x86_64.rpm texlive-lwarp-20180414-34.u1.fos23.noarch.rpm texlive-lyluatex-svn47584-34.u1.fos23.noarch.rpm texlive-make4ht-20180414-34.u1.fos23.noarch.rpm texlive-makedtx-20180414-34.u1.fos23.noarch.rpm texlive-makeindex-20180414-34.u1.fos23.x86_64.rpm texlive-match_parens-20180414-34.u1.fos23.noarch.rpm texlive-mathspic-20180414-34.u1.fos23.noarch.rpm texlive-metafont-20180414-34.u1.fos23.x86_64.rpm texlive-metapost-20180414-34.u1.fos23.x86_64.rpm texlive-mex-20180414-34.u1.fos23.noarch.rpm texlive-mflua-20180414-34.u1.fos23.x86_64.rpm texlive-mfware-20180414-34.u1.fos23.x86_64.rpm texlive-mf2pt1-20180414-34.u1.fos23.noarch.rpm texlive-mkgrkindex-20180414-34.u1.fos23.noarch.rpm texlive-mkjobtexmf-20180414-34.u1.fos23.noarch.rpm texlive-mkpic-20180414-34.u1.fos23.noarch.rpm texlive-mltex-20180414-34.u1.fos23.noarch.rpm texlive-mptopdf-20180414-34.u1.fos23.noarch.rpm texlive-multibibliography-20180414-34.u1.fos23.noarch.rpm texlive-musixtex-20180414-34.u1.fos23.noarch.rpm texlive-musixtnt-20180414-34.u1.fos23.x86_64.rpm texlive-m-tx-20180414-34.u1.fos23.x86_64.rpm texlive-oberdiek-20180414-34.u1.fos23.noarch.rpm texlive-omegaware-20180414-34.u1.fos23.x86_64.rpm texlive-patgen-20180414-34.u1.fos23.x86_64.rpm texlive-pax-20180414-34.u1.fos23.noarch.rpm texlive-pdfbook2-20180414-34.u1.fos23.noarch.rpm texlive-pdfcrop-20180414-34.u1.fos23.noarch.rpm texlive-pdfjam-20180414-34.u1.fos23.noarch.rpm texlive-pdflatexpicscale-20180414-34.u1.fos23.noarch.rpm texlive-pdftex-20180414-34.u1.fos23.x86_64.rpm texlive-pdftools-20180414-34.u1.fos23.x86_64.rpm texlive-pdfxup-20180414-34.u1.fos23.noarch.rpm texlive-pedigree-perl-20180414-34.u1.fos23.noarch.rpm texlive-perltex-20180414-34.u1.fos23.noarch.rpm texlive-petri-nets-20180414-34.u1.fos23.noarch.rpm texlive-pfarrei-20180414-34.u1.fos23.noarch.rpm texlive-pkfix-20180414-34.u1.fos23.noarch.rpm texlive-pkfix-helper-20180414-34.u1.fos23.noarch.rpm texlive-pmx-20180414-34.u1.fos23.x86_64.rpm texlive-pmxchords-20180414-34.u1.fos23.noarch.rpm texlive-pstools-20180414-34.u1.fos23.x86_64.rpm texlive-pst2pdf-20180414-34.u1.fos23.noarch.rpm texlive-pst-pdf-20180414-34.u1.fos23.noarch.rpm texlive-ps2pk-20180414-34.u1.fos23.x86_64.rpm texlive-ptex-20180414-34.u1.fos23.x86_64.rpm texlive-ptex-fontmaps-20180414-34.u1.fos23.noarch.rpm texlive-ptex2pdf-20180414-34.u1.fos23.noarch.rpm texlive-purifyeps-20180414-34.u1.fos23.noarch.rpm texlive-pygmentex-20180414-34.u1.fos23.noarch.rpm texlive-pythontex-20180414-34.u1.fos23.noarch.rpm texlive-rubik-20180414-34.u1.fos23.noarch.rpm texlive-seetexk-20180414-34.u1.fos23.x86_64.rpm texlive-splitindex-20180414-34.u1.fos23.noarch.rpm texlive-srcredact-20180414-34.u1.fos23.noarch.rpm texlive-sty2dtx-20180414-34.u1.fos23.noarch.rpm texlive-svn-multi-20180414-34.u1.fos23.noarch.rpm texlive-synctex-20180414-34.u1.fos23.x86_64.rpm texlive-tetex-20180414-34.u1.fos23.noarch.rpm texlive-tex-20180414-34.u1.fos23.x86_64.rpm texlive-tex4ebook-20180414-34.u1.fos23.noarch.rpm texlive-tex4ht-20180414-34.u1.fos23.x86_64.rpm texlive-texconfig-20180414-34.u1.fos23.noarch.rpm texlive-texcount-20180414-34.u1.fos23.noarch.rpm texlive-texdef-20180414-34.u1.fos23.noarch.rpm texlive-texdiff-20180414-34.u1.fos23.noarch.rpm texlive-texdirflatten-20180414-34.u1.fos23.noarch.rpm texlive-texdoc-20180414-34.u1.fos23.noarch.rpm texlive-texdoctk-20180414-34.u1.fos23.noarch.rpm texlive-texfot-20180414-34.u1.fos23.noarch.rpm texlive-texliveonfly-20180414-34.u1.fos23.noarch.rpm texlive-texlive-en-20180414-34.u1.fos23.noarch.rpm texlive-texlive-scripts-20180414-34.u1.fos23.noarch.rpm texlive-texlive.infra-20180414-34.u1.fos23.noarch.rpm texlive-texloganalyser-20180414-34.u1.fos23.noarch.rpm texlive-texosquery-20180414-34.u1.fos23.noarch.rpm texlive-texsis-20180414-34.u1.fos23.noarch.rpm texlive-texware-20180414-34.u1.fos23.x86_64.rpm texlive-thumbpdf-20180414-34.u1.fos23.noarch.rpm texlive-tie-20180414-34.u1.fos23.x86_64.rpm texlive-tpic2pdftex-20180414-34.u1.fos23.noarch.rpm texlive-ttfutils-20180414-34.u1.fos23.x86_64.rpm texlive-typeoutfileinfo-20180414-34.u1.fos23.noarch.rpm texlive-ulqda-20180414-34.u1.fos23.noarch.rpm texlive-uptex-20180414-34.u1.fos23.x86_64.rpm texlive-urlbst-20180414-34.u1.fos23.noarch.rpm texlive-velthuis-20180414-34.u1.fos23.x86_64.rpm texlive-vlna-20180414-34.u1.fos23.x86_64.rpm texlive-vpe-20180414-34.u1.fos23.noarch.rpm texlive-web-20180414-34.u1.fos23.x86_64.rpm texlive-wordcount-20180414-34.u1.fos23.noarch.rpm texlive-xdvi-20180414-34.u1.fos23.x86_64.rpm texlive-xetex-20180414-34.u1.fos23.x86_64.rpm texlive-xmltex-20180414-34.u1.fos23.noarch.rpm texlive-yplan-20180414-34.u1.fos23.noarch.rpm texlive-base-20180414-34.u1.fos23.aarch64.rpm texlive-afm2pl-20180414-34.u1.fos23.aarch64.rpm texlive-aleph-20180414-34.u1.fos23.aarch64.rpm texlive-autosp-20180414-34.u1.fos23.aarch64.rpm texlive-axodraw2-20180414-34.u1.fos23.aarch64.rpm texlive-bibtex-20180414-34.u1.fos23.aarch64.rpm texlive-bibtexu-20180414-34.u1.fos23.aarch64.rpm texlive-bibtex8-20180414-34.u1.fos23.aarch64.rpm texlive-chktex-20180414-34.u1.fos23.aarch64.rpm texlive-cjkutils-20180414-34.u1.fos23.aarch64.rpm texlive-ctie-20180414-34.u1.fos23.aarch64.rpm texlive-cweb-20180414-34.u1.fos23.aarch64.rpm texlive-detex-20180414-34.u1.fos23.aarch64.rpm texlive-dtl-20180414-34.u1.fos23.aarch64.rpm texlive-dvi2tty-20180414-34.u1.fos23.aarch64.rpm texlive-dvicopy-20180414-34.u1.fos23.aarch64.rpm texlive-dvidvi-20180414-34.u1.fos23.aarch64.rpm texlive-dviljk-20180414-34.u1.fos23.aarch64.rpm texlive-dvipdfmx-20180414-34.u1.fos23.aarch64.rpm texlive-dvipng-20180414-34.u1.fos23.aarch64.rpm texlive-dvipos-20180414-34.u1.fos23.aarch64.rpm texlive-dvips-20180414-34.u1.fos23.aarch64.rpm texlive-dvisvgm-20180414-34.u1.fos23.aarch64.rpm texlive-fontware-20180414-34.u1.fos23.aarch64.rpm texlive-gregoriotex-20180414-34.u1.fos23.aarch64.rpm texlive-gsftopk-20180414-34.u1.fos23.aarch64.rpm texlive-kpathsea-20180414-34.u1.fos23.aarch64.rpm texlive-lacheck-20180414-34.u1.fos23.aarch64.rpm texlive-lcdftypetools-20180414-34.u1.fos23.aarch64.rpm texlive-lib-20180414-34.u1.fos23.aarch64.rpm texlive-lib-devel-20180414-34.u1.fos23.aarch64.rpm texlive-luatex-20180414-34.u1.fos23.aarch64.rpm texlive-makeindex-20180414-34.u1.fos23.aarch64.rpm texlive-metafont-20180414-34.u1.fos23.aarch64.rpm texlive-metapost-20180414-34.u1.fos23.aarch64.rpm texlive-mflua-20180414-34.u1.fos23.aarch64.rpm texlive-mfware-20180414-34.u1.fos23.aarch64.rpm texlive-musixtnt-20180414-34.u1.fos23.aarch64.rpm texlive-m-tx-20180414-34.u1.fos23.aarch64.rpm texlive-omegaware-20180414-34.u1.fos23.aarch64.rpm texlive-patgen-20180414-34.u1.fos23.aarch64.rpm texlive-pdftex-20180414-34.u1.fos23.aarch64.rpm texlive-pdftools-20180414-34.u1.fos23.aarch64.rpm texlive-pmx-20180414-34.u1.fos23.aarch64.rpm texlive-pstools-20180414-34.u1.fos23.aarch64.rpm texlive-ps2pk-20180414-34.u1.fos23.aarch64.rpm texlive-ptex-20180414-34.u1.fos23.aarch64.rpm texlive-seetexk-20180414-34.u1.fos23.aarch64.rpm texlive-synctex-20180414-34.u1.fos23.aarch64.rpm texlive-tex-20180414-34.u1.fos23.aarch64.rpm texlive-tex4ht-20180414-34.u1.fos23.aarch64.rpm texlive-texware-20180414-34.u1.fos23.aarch64.rpm texlive-tie-20180414-34.u1.fos23.aarch64.rpm texlive-ttfutils-20180414-34.u1.fos23.aarch64.rpm texlive-uptex-20180414-34.u1.fos23.aarch64.rpm texlive-velthuis-20180414-34.u1.fos23.aarch64.rpm texlive-vlna-20180414-34.u1.fos23.aarch64.rpm texlive-web-20180414-34.u1.fos23.aarch64.rpm texlive-xdvi-20180414-34.u1.fos23.aarch64.rpm texlive-xetex-20180414-34.u1.fos23.aarch64.rpm FusionOS-SA-2023-2174 Critical FusionOS CVE-2023-0667:Due to failure in validating the length provided by an attacker-crafted MSMMS packet, Wireshark version 4.0.5 and prior, in an unusual configuration, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark CVE-2023-2952:XRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file FusionOS wireshark-3.6.14-1.u4.fos23.x86_64.rpm wireshark-devel-3.6.14-1.u4.fos23.x86_64.rpm wireshark-help-3.6.14-1.u4.fos23.x86_64.rpm wireshark-3.6.14-1.u4.fos23.aarch64.rpm wireshark-devel-3.6.14-1.u4.fos23.aarch64.rpm wireshark-help-3.6.14-1.u4.fos23.aarch64.rpm FusionOS-SA-2023-2175 Moderate FusionOS CVE-2023-3428:A vulnerability was found in ImageMagick <=7.1.1, where heap-based buffer overflow was found in coders/tiff.c. CVE-2023-34474:A heap-based buffer overflow issue was discovered in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c. A local attacker could trick the user in opening specially crafted file, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service. CVE-2023-34475:A heap use after free issue was discovered in ImageMagick's ReplaceXmpValue() function in MagickCore/profile.c. An attacker could trick user to open a specially crafted file to convert, triggering an heap-use-after-free write error, allowing an application to crash, resulting in a denial of service. FusionOS ImageMagick-7.1.1.8-4.u4.fos23.x86_64.rpm ImageMagick-devel-7.1.1.8-4.u4.fos23.x86_64.rpm ImageMagick-help-7.1.1.8-4.u4.fos23.x86_64.rpm ImageMagick-perl-7.1.1.8-4.u4.fos23.x86_64.rpm ImageMagick-c++-7.1.1.8-4.u4.fos23.x86_64.rpm ImageMagick-c++-devel-7.1.1.8-4.u4.fos23.x86_64.rpm ImageMagick-7.1.1.8-4.u4.fos23.aarch64.rpm ImageMagick-devel-7.1.1.8-4.u4.fos23.aarch64.rpm ImageMagick-help-7.1.1.8-4.u4.fos23.aarch64.rpm ImageMagick-perl-7.1.1.8-4.u4.fos23.aarch64.rpm ImageMagick-c++-7.1.1.8-4.u4.fos23.aarch64.rpm ImageMagick-c++-devel-7.1.1.8-4.u4.fos23.aarch64.rpm FusionOS-SA-2023-2176 Important FusionOS CVE-2023-37464:OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version >= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm (e.g. AES CBC). FusionOS cjose-0.6.2.2-1.fos23.x86_64.rpm cjose-devel-0.6.2.2-1.fos23.x86_64.rpm cjose-0.6.2.2-1.fos23.aarch64.rpm cjose-devel-0.6.2.2-1.fos23.aarch64.rpm FusionOS-SA-2023-2177 Moderate FusionOS CVE-2023-32001:libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called `stat()` followed by `fopen()` in a way that made it vulnerable to a TOCTOU race condition problem. By exploiting this flaw, an attacker could trick the victim to create or overwrite protected files holding this data in ways it was not intended to. FusionOS curl-7.79.1-23.u10.fos23.x86_64.rpm libcurl-7.79.1-23.u10.fos23.x86_64.rpm libcurl-devel-7.79.1-23.u10.fos23.x86_64.rpm curl-help-7.79.1-23.u10.fos23.noarch.rpm curl-7.79.1-23.u10.fos23.aarch64.rpm libcurl-7.79.1-23.u10.fos23.aarch64.rpm libcurl-devel-7.79.1-23.u10.fos23.aarch64.rpm FusionOS-SA-2023-2178 Moderate FusionOS CVE-2023-34969:D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6. FusionOS dbus-1.12.20-9.u1.fos23.x86_64.rpm dbus-libs-1.12.20-9.u1.fos23.x86_64.rpm dbus-daemon-1.12.20-9.u1.fos23.x86_64.rpm dbus-common-1.12.20-9.u1.fos23.noarch.rpm dbus-tools-1.12.20-9.u1.fos23.x86_64.rpm dbus-devel-1.12.20-9.u1.fos23.x86_64.rpm dbus-x11-1.12.20-9.u1.fos23.x86_64.rpm dbus-help-1.12.20-9.u1.fos23.noarch.rpm dbus-1.12.20-9.u1.fos23.aarch64.rpm dbus-libs-1.12.20-9.u1.fos23.aarch64.rpm dbus-daemon-1.12.20-9.u1.fos23.aarch64.rpm dbus-tools-1.12.20-9.u1.fos23.aarch64.rpm dbus-devel-1.12.20-9.u1.fos23.aarch64.rpm dbus-x11-1.12.20-9.u1.fos23.aarch64.rpm FusionOS-SA-2023-2179 Important FusionOS CVE-2021-44648:GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12. FusionOS gdk-pixbuf2-2.42.6-6.u1.fos23.x86_64.rpm gdk-pixbuf2-modules-2.42.6-6.u1.fos23.x86_64.rpm gdk-pixbuf2-devel-2.42.6-6.u1.fos23.x86_64.rpm gdk-pixbuf2-tests-2.42.6-6.u1.fos23.x86_64.rpm gdk-pixbuf2-help-2.42.6-6.u1.fos23.noarch.rpm gdk-pixbuf2-2.42.6-6.u1.fos23.aarch64.rpm gdk-pixbuf2-modules-2.42.6-6.u1.fos23.aarch64.rpm gdk-pixbuf2-devel-2.42.6-6.u1.fos23.aarch64.rpm gdk-pixbuf2-tests-2.42.6-6.u1.fos23.aarch64.rpm FusionOS-SA-2023-2181 Important FusionOS CVE-2023-2976:Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class. Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows. FusionOS guava20-20.0-11.u1.fos23.noarch.rpm guava20-help-20.0-11.u1.fos23.noarch.rpm FusionOS-SA-2023-2182 Important FusionOS CVE-2023-38403:iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field. FusionOS iperf3-3.10.1-3.u1.fos23.x86_64.rpm iperf3-devel-3.10.1-3.u1.fos23.x86_64.rpm iperf3-help-3.10.1-3.u1.fos23.noarch.rpm iperf3-3.10.1-3.u1.fos23.aarch64.rpm iperf3-devel-3.10.1-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2183 Important FusionOS CVE-2023-3117:A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and anonymous sets in batch requests, which can lead to performing arbitrary reads and writes in kernel memory. This flaw allows a local user with CAP_NET_ADMIN capability to crash or potentially escalate their privileges on the system. CVE-2023-3390:A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97. CVE-2022-45886:An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a .disconnect versus dvb_device_open race condition that leads to a use-after-free. CVE-2023-3338:A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue could allow a remote user to crash the system. CVE-2023-3220:An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() and will cause the NULL Pointer Dereference. CVE-2023-31248:Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace CVE-2023-3567:A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This flaw allows an attacker with local user access to cause a system crash or leak internal kernel information. CVE-2023-2163:bpf: incorrect verifier pruning due to missing register precision taints, which may lead to out-of-band read/write access due to an incorrect verifier conclusion. CVE-2023-35001:Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace CVE-2023-32248:A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_TREE_CONNECT and SMB2_QUERY_INFO commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. CVE-2023-32255:Linux Kernel ksmbd Session Setup Memory Leak Denial-of-Service Vulnerability FusionOS kernel-5.10.0-136.42.0.120.u69.fos23.x86_64.rpm kernel-headers-5.10.0-136.42.0.120.u69.fos23.x86_64.rpm kernel-devel-5.10.0-136.42.0.120.u69.fos23.x86_64.rpm kernel-tools-5.10.0-136.42.0.120.u69.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.42.0.120.u69.fos23.x86_64.rpm perf-5.10.0-136.42.0.120.u69.fos23.x86_64.rpm python3-perf-5.10.0-136.42.0.120.u69.fos23.x86_64.rpm bpftool-5.10.0-136.42.0.120.u69.fos23.x86_64.rpm kernel-5.10.0-136.42.0.120.u69.fos23.aarch64.rpm kernel-headers-5.10.0-136.42.0.120.u69.fos23.aarch64.rpm kernel-devel-5.10.0-136.42.0.120.u69.fos23.aarch64.rpm kernel-tools-5.10.0-136.42.0.120.u69.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.42.0.120.u69.fos23.aarch64.rpm perf-5.10.0-136.42.0.120.u69.fos23.aarch64.rpm python3-perf-5.10.0-136.42.0.120.u69.fos23.aarch64.rpm bpftool-5.10.0-136.42.0.120.u69.fos23.aarch64.rpm FusionOS-SA-2023-2184 Important FusionOS CVE-2023-3138:A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption. FusionOS libX11-1.7.2-6.u1.fos23.x86_64.rpm libX11-devel-1.7.2-6.u1.fos23.x86_64.rpm libX11-help-1.7.2-6.u1.fos23.noarch.rpm libX11-1.7.2-6.u1.fos23.aarch64.rpm libX11-devel-1.7.2-6.u1.fos23.aarch64.rpm FusionOS-SA-2023-2185 Critical FusionOS CVE-2023-39976:log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered. FusionOS libqb-2.0.0-2.u1.fos23.x86_64.rpm libqb-devel-2.0.0-2.u1.fos23.x86_64.rpm libqb-help-2.0.0-2.u1.fos23.noarch.rpm doxygen2man-2.0.0-2.u1.fos23.x86_64.rpm libqb-2.0.0-2.u1.fos23.aarch64.rpm libqb-devel-2.0.0-2.u1.fos23.aarch64.rpm doxygen2man-2.0.0-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2186 Low FusionOS CVE-2023-38288:Multiple potential integer overflow in raw2tiff.c in libtiff <= 4.5.1 can allow remote attackers to cause a denial of service (application crash) or possibly execute an arbitrary code via a crafted tiff image which triggers a heap-based buffer overflow. CVE-2023-38289:Multiple potential integer overflow in tiffcp.c in libtiff <= 4.5.1 can allow remote attackers to cause a denial of service (application crash) or possibly execute an arbitrary code via a crafted tiff image which triggers a heap-based buffer overflow. FusionOS libtiff-4.3.0-30.u6.fos23.x86_64.rpm libtiff-devel-4.3.0-30.u6.fos23.x86_64.rpm libtiff-static-4.3.0-30.u6.fos23.x86_64.rpm libtiff-tools-4.3.0-30.u6.fos23.x86_64.rpm libtiff-help-4.3.0-30.u6.fos23.noarch.rpm libtiff-4.3.0-30.u6.fos23.aarch64.rpm libtiff-devel-4.3.0-30.u6.fos23.aarch64.rpm libtiff-static-4.3.0-30.u6.fos23.aarch64.rpm libtiff-tools-4.3.0-30.u6.fos23.aarch64.rpm FusionOS-SA-2023-2187 Important FusionOS CVE-2023-35945:Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11. FusionOS nghttp2-1.46.0-4.u2.fos23.x86_64.rpm libnghttp2-1.46.0-4.u2.fos23.x86_64.rpm libnghttp2-devel-1.46.0-4.u2.fos23.x86_64.rpm nghttp2-help-1.46.0-4.u2.fos23.noarch.rpm nghttp2-1.46.0-4.u2.fos23.aarch64.rpm libnghttp2-1.46.0-4.u2.fos23.aarch64.rpm libnghttp2-devel-1.46.0-4.u2.fos23.aarch64.rpm FusionOS-SA-2023-2188 Important FusionOS CVE-2023-0286:There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. FusionOS openresty-openssl111-asan-1.1.1h-2.u2.fos23.x86_64.rpm openresty-openssl111-asan-1.1.1h-2.u2.fos23.aarch64.rpm FusionOS-SA-2023-2189 Critical FusionOS CVE-2023-38408:The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009. FusionOS openssh-8.8p1-23.u12.fos23.x86_64.rpm openssh-clients-8.8p1-23.u12.fos23.x86_64.rpm openssh-server-8.8p1-23.u12.fos23.x86_64.rpm openssh-keycat-8.8p1-23.u12.fos23.x86_64.rpm openssh-askpass-8.8p1-23.u12.fos23.x86_64.rpm pam_ssh_agent_auth-0.10.4-4.23.u12.fos23.x86_64.rpm openssh-help-8.8p1-23.u12.fos23.noarch.rpm openssh-8.8p1-23.u12.fos23.aarch64.rpm openssh-clients-8.8p1-23.u12.fos23.aarch64.rpm openssh-server-8.8p1-23.u12.fos23.aarch64.rpm openssh-keycat-8.8p1-23.u12.fos23.aarch64.rpm openssh-askpass-8.8p1-23.u12.fos23.aarch64.rpm pam_ssh_agent_auth-0.10.4-4.23.u12.fos23.aarch64.rpm FusionOS-SA-2023-2190 Moderate FusionOS CVE-2023-3817:Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. CVE-2023-3446:Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. FusionOS openssl-1.1.1m-25.u10.fos23.x86_64.rpm openssl-libs-1.1.1m-25.u10.fos23.x86_64.rpm openssl-perl-1.1.1m-25.u10.fos23.x86_64.rpm openssl-devel-1.1.1m-25.u10.fos23.x86_64.rpm openssl-help-1.1.1m-25.u10.fos23.noarch.rpm openssl-1.1.1m-25.u10.fos23.aarch64.rpm openssl-libs-1.1.1m-25.u10.fos23.aarch64.rpm openssl-perl-1.1.1m-25.u10.fos23.aarch64.rpm openssl-devel-1.1.1m-25.u10.fos23.aarch64.rpm FusionOS-SA-2023-2191 Important FusionOS CVE-2022-41409:Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input. FusionOS pcre2-10.39-9.u3.fos23.x86_64.rpm pcre2-devel-10.39-9.u3.fos23.x86_64.rpm pcre2-help-10.39-9.u3.fos23.noarch.rpm pcre2-10.39-9.u3.fos23.aarch64.rpm pcre2-devel-10.39-9.u3.fos23.aarch64.rpm FusionOS-SA-2023-2192 Important FusionOS CVE-2023-31486:HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. FusionOS perl-5.34.0-8.u2.fos23.x86_64.rpm perl-libs-5.34.0-8.u2.fos23.x86_64.rpm perl-devel-5.34.0-8.u2.fos23.x86_64.rpm perl-help-5.34.0-8.u2.fos23.noarch.rpm perl-5.34.0-8.u2.fos23.aarch64.rpm perl-libs-5.34.0-8.u2.fos23.aarch64.rpm perl-devel-5.34.0-8.u2.fos23.aarch64.rpm FusionOS-SA-2023-2193 Important FusionOS CVE-2023-31484:CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. FusionOS perl-CPAN-2.29-2.u1.fos23.noarch.rpm perl-CPAN-help-2.29-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2194 Moderate FusionOS CVE-2022-41946:pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, InputStream)` or `PreparedStatemet.setBytea(int, InputStream)` will create a temporary file if the InputStream is larger than 2k. This will create a temporary file which is readable by other users on Unix like systems, but not MacOS. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. Java 1.7 and higher users: this vulnerability is fixed in 4.5.0. Java 1.6 and lower users: no patch is available. If you are unable to patch, or are stuck running on Java 1.6, specifying the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user will mitigate this vulnerability. FusionOS postgresql-jdbc-42.4.1-2.u1.fos23.noarch.rpm postgresql-jdbc-javadoc-42.4.1-2.u1.fos23.noarch.rpm postgresql-jdbc-help-42.4.1-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2195 Moderate FusionOS CVE-2023-4016:Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap. FusionOS procps-ng-4.0.2-10.u6.fos23.x86_64.rpm procps-ng-devel-4.0.2-10.u6.fos23.x86_64.rpm procps-ng-i18n-4.0.2-10.u6.fos23.noarch.rpm procps-ng-help-4.0.2-10.u6.fos23.noarch.rpm procps-ng-4.0.2-10.u6.fos23.aarch64.rpm procps-ng-devel-4.0.2-10.u6.fos23.aarch64.rpm FusionOS-SA-2023-2196 Critical FusionOS CVE-2023-37920:Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. CVE-2022-23491:Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion. FusionOS python3-certifi-2023.7.22-1.fos23.noarch.rpm python-certifi-help-2023.7.22-1.fos23.noarch.rpm FusionOS-SA-2023-2197 Moderate FusionOS CVE-2022-40896:A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer. FusionOS python3-pygments-2.10.0-4.u1.fos23.noarch.rpm python-pygments-help-2.10.0-4.u1.fos23.noarch.rpm FusionOS-SA-2023-2198 Moderate FusionOS CVE-2023-28370:Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL. FusionOS python3-tornado-6.1-2.u1.fos23.x86_64.rpm python-tornado-help-6.1-2.u1.fos23.x86_64.rpm python3-tornado-6.1-2.u1.fos23.aarch64.rpm python-tornado-help-6.1-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2199 Important FusionOS CVE-2023-23934:Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3. CVE-2023-25577:Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers. Version 2.2.3 contains a patch for this issue. FusionOS python3-werkzeug-2.0.3-4.u2.fos23.noarch.rpm python-werkzeug-help-2.0.3-4.u2.fos23.noarch.rpm FusionOS-SA-2023-2200 Low FusionOS CVE-2007-4559:Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267. FusionOS python3-3.9.9-25.u6.fos23.x86_64.rpm python3-unversioned-command-3.9.9-25.u6.fos23.x86_64.rpm python3-devel-3.9.9-25.u6.fos23.x86_64.rpm python3-debug-3.9.9-25.u6.fos23.x86_64.rpm python3-help-3.9.9-25.u6.fos23.noarch.rpm python3-3.9.9-25.u6.fos23.aarch64.rpm python3-unversioned-command-3.9.9-25.u6.fos23.aarch64.rpm python3-devel-3.9.9-25.u6.fos23.aarch64.rpm python3-debug-3.9.9-25.u6.fos23.aarch64.rpm FusionOS-SA-2023-2201 Important FusionOS CVE-2023-0664:A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system. CVE-2023-2861:A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder. FusionOS qemu-6.2.0-76.u4.fos23.x86_64.rpm qemu-guest-agent-6.2.0-76.u4.fos23.x86_64.rpm qemu-help-6.2.0-76.u4.fos23.noarch.rpm qemu-img-6.2.0-76.u4.fos23.x86_64.rpm qemu-block-rbd-6.2.0-76.u4.fos23.x86_64.rpm qemu-block-ssh-6.2.0-76.u4.fos23.x86_64.rpm qemu-block-iscsi-6.2.0-76.u4.fos23.x86_64.rpm qemu-block-curl-6.2.0-76.u4.fos23.x86_64.rpm qemu-hw-usb-host-6.2.0-76.u4.fos23.x86_64.rpm qemu-seabios-6.2.0-76.u4.fos23.x86_64.rpm qemu-system-aarch64-6.2.0-76.u4.fos23.x86_64.rpm qemu-system-arm-6.2.0-76.u4.fos23.x86_64.rpm qemu-system-x86_64-6.2.0-76.u4.fos23.x86_64.rpm qemu-system-riscv-6.2.0-76.u4.fos23.x86_64.rpm qemu-6.2.0-76.u4.fos23.aarch64.rpm qemu-guest-agent-6.2.0-76.u4.fos23.aarch64.rpm qemu-img-6.2.0-76.u4.fos23.aarch64.rpm qemu-block-rbd-6.2.0-76.u4.fos23.aarch64.rpm qemu-block-ssh-6.2.0-76.u4.fos23.aarch64.rpm qemu-block-iscsi-6.2.0-76.u4.fos23.aarch64.rpm qemu-block-curl-6.2.0-76.u4.fos23.aarch64.rpm qemu-hw-usb-host-6.2.0-76.u4.fos23.aarch64.rpm qemu-system-aarch64-6.2.0-76.u4.fos23.aarch64.rpm qemu-system-arm-6.2.0-76.u4.fos23.aarch64.rpm qemu-system-x86_64-6.2.0-76.u4.fos23.aarch64.rpm qemu-system-riscv-6.2.0-76.u4.fos23.aarch64.rpm FusionOS-SA-2023-2202 Moderate FusionOS CVE-2023-28362:A Cross-site Scripting (XSS) vulnerability was found in Actionpack due to improper sanitization of user-supplied values. This allows provided values to contain characters that are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned location header. FusionOS rubygem-actionpack-6.1.4.1-3.u1.fos23.noarch.rpm rubygem-actionpack-doc-6.1.4.1-3.u1.fos23.noarch.rpm FusionOS-SA-2023-2203 Important FusionOS CVE-2022-2127:An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in a crash. CVE-2023-3347:A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and server, affecting the integrity of the data. CVE-2023-34966:An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not validate a field in the network packet that contains the count of elements in an array-like structure. By passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a denial of service condition. CVE-2023-34967:A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all other clients this worker serves. CVE-2023-34968:A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker with a targeted RPC request to view the information that is part of the disclosed path. FusionOS samba-4.17.5-6.u3.fos23.x86_64.rpm samba-libs-4.17.5-6.u3.fos23.x86_64.rpm samba-client-4.17.5-6.u3.fos23.x86_64.rpm samba-common-4.17.5-6.u3.fos23.x86_64.rpm samba-common-tools-4.17.5-6.u3.fos23.x86_64.rpm samba-dc-4.17.5-6.u3.fos23.x86_64.rpm samba-dc-provision-4.17.5-6.u3.fos23.x86_64.rpm samba-dc-bind-dlz-4.17.5-6.u3.fos23.x86_64.rpm samba-devel-4.17.5-6.u3.fos23.x86_64.rpm samba-vfs-glusterfs-4.17.5-6.u3.fos23.x86_64.rpm samba-krb5-printing-4.17.5-6.u3.fos23.x86_64.rpm libsmbclient-4.17.5-6.u3.fos23.x86_64.rpm libsmbclient-devel-4.17.5-6.u3.fos23.x86_64.rpm libwbclient-4.17.5-6.u3.fos23.x86_64.rpm libwbclient-devel-4.17.5-6.u3.fos23.x86_64.rpm python3-samba-4.17.5-6.u3.fos23.x86_64.rpm python3-samba-test-4.17.5-6.u3.fos23.x86_64.rpm python3-samba-dc-4.17.5-6.u3.fos23.x86_64.rpm samba-pidl-4.17.5-6.u3.fos23.noarch.rpm samba-test-4.17.5-6.u3.fos23.x86_64.rpm samba-usershares-4.17.5-6.u3.fos23.x86_64.rpm samba-winbind-4.17.5-6.u3.fos23.x86_64.rpm samba-winbind-clients-4.17.5-6.u3.fos23.x86_64.rpm samba-winbind-krb5-locator-4.17.5-6.u3.fos23.x86_64.rpm samba-winbind-modules-4.17.5-6.u3.fos23.x86_64.rpm ctdb-4.17.5-6.u3.fos23.x86_64.rpm samba-help-4.17.5-6.u3.fos23.x86_64.rpm samba-4.17.5-6.u3.fos23.aarch64.rpm samba-libs-4.17.5-6.u3.fos23.aarch64.rpm samba-client-4.17.5-6.u3.fos23.aarch64.rpm samba-common-4.17.5-6.u3.fos23.aarch64.rpm samba-common-tools-4.17.5-6.u3.fos23.aarch64.rpm samba-dc-4.17.5-6.u3.fos23.aarch64.rpm samba-dc-provision-4.17.5-6.u3.fos23.aarch64.rpm samba-dc-bind-dlz-4.17.5-6.u3.fos23.aarch64.rpm samba-devel-4.17.5-6.u3.fos23.aarch64.rpm samba-krb5-printing-4.17.5-6.u3.fos23.aarch64.rpm libsmbclient-4.17.5-6.u3.fos23.aarch64.rpm libsmbclient-devel-4.17.5-6.u3.fos23.aarch64.rpm libwbclient-4.17.5-6.u3.fos23.aarch64.rpm libwbclient-devel-4.17.5-6.u3.fos23.aarch64.rpm python3-samba-4.17.5-6.u3.fos23.aarch64.rpm python3-samba-test-4.17.5-6.u3.fos23.aarch64.rpm python3-samba-dc-4.17.5-6.u3.fos23.aarch64.rpm samba-test-4.17.5-6.u3.fos23.aarch64.rpm samba-usershares-4.17.5-6.u3.fos23.aarch64.rpm samba-winbind-4.17.5-6.u3.fos23.aarch64.rpm samba-winbind-clients-4.17.5-6.u3.fos23.aarch64.rpm samba-winbind-krb5-locator-4.17.5-6.u3.fos23.aarch64.rpm samba-winbind-modules-4.17.5-6.u3.fos23.aarch64.rpm ctdb-4.17.5-6.u3.fos23.aarch64.rpm samba-help-4.17.5-6.u3.fos23.aarch64.rpm FusionOS-SA-2023-2204 Moderate FusionOS CVE-2023-25399:A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function. FusionOS python3-scipy-1.6.2-2.u1.fos23.x86_64.rpm python3-scipy-1.6.2-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2205 Important FusionOS CVE-2018-0737:The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. CVE-2021-23840:Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). FusionOS shim-15.6-10.u7.fos23.x86_64.rpm shim-15.6-10.u7.fos23.aarch64.rpm FusionOS-SA-2023-2206 Moderate FusionOS CVE-2023-36191:sqlite3 v3.40.1 was discovered to contain a segmentation violation at /sqlite3_aflpp/shell.c. FusionOS sqlite-3.37.2-6.u3.fos23.x86_64.rpm sqlite-devel-3.37.2-6.u3.fos23.x86_64.rpm sqlite-help-3.37.2-6.u3.fos23.noarch.rpm sqlite-3.37.2-6.u3.fos23.aarch64.rpm sqlite-devel-3.37.2-6.u3.fos23.aarch64.rpm FusionOS-SA-2023-2207 Critical FusionOS CVE-2016-9840:inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. CVE-2016-9841:inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. CVE-2016-9842:The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers. CVE-2016-9843:The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation. FusionOS syslinux-6.04-14.u2.fos23.x86_64.rpm syslinux-perl-6.04-14.u2.fos23.x86_64.rpm syslinux-devel-6.04-14.u2.fos23.x86_64.rpm syslinux-extlinux-6.04-14.u2.fos23.x86_64.rpm syslinux-tftpboot-6.04-14.u2.fos23.noarch.rpm syslinux-extlinux-nonlinux-6.04-14.u2.fos23.noarch.rpm syslinux-nonlinux-6.04-14.u2.fos23.noarch.rpm syslinux-efi64-6.04-14.u2.fos23.x86_64.rpm FusionOS-SA-2023-2208 Moderate FusionOS CVE-2023-3648:Kafka dissector crash in Wireshark 4.0.0 to 4.0.6 and 3.6.0 to 3.6.14 allows denial of service via packet injection or crafted capture file FusionOS wireshark-3.6.14-2.u5.fos23.x86_64.rpm wireshark-devel-3.6.14-2.u5.fos23.x86_64.rpm wireshark-help-3.6.14-2.u5.fos23.x86_64.rpm wireshark-3.6.14-2.u5.fos23.aarch64.rpm wireshark-devel-3.6.14-2.u5.fos23.aarch64.rpm wireshark-help-3.6.14-2.u5.fos23.aarch64.rpm FusionOS-SA-2023-2209 Moderate FusionOS CVE-2023-37732:Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c and /elf/elf.c, which allows the attacker to cause a denial of service via a crafted file. FusionOS yasm-1.3.0-11.u2.fos23.x86_64.rpm yasm-1.3.0-11.u2.fos23.aarch64.rpm FusionOS-SA-2023-2210 Important FusionOS CVE-2023-30577:AMANDA (Advanced Maryland Automatic Network Disk Archiver) before tag-community-3.5.4 mishandles argument checking for runtar.c, a different vulnerability than CVE-2022-37705. FusionOS amanda-3.5.4-1.u2.fos23.x86_64.rpm amanda-help-3.5.4-1.u2.fos23.noarch.rpm amanda-3.5.4-1.u2.fos23.aarch64.rpm FusionOS-SA-2023-2211 Important FusionOS CVE-2021-46174:Heap-based Buffer Overflow in function bfd_getl32 in Binutils objdump 3.37. CVE-2023-1972:A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability. CVE-2022-48064:GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack. CVE-2022-4285:An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599. CVE-2022-47696:An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function compare_symbols. CVE-2022-47011:An issue was discovered function parse_stab_struct_fields in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. CVE-2022-47008:An issue was discovered function make_tempdir, and make_tempname in bucomm.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. FusionOS binutils-2.37-22.u6.fos23.x86_64.rpm binutils-devel-2.37-22.u6.fos23.x86_64.rpm binutils-help-2.37-22.u6.fos23.x86_64.rpm binutils-2.37-22.u6.fos23.aarch64.rpm binutils-devel-2.37-22.u6.fos23.aarch64.rpm binutils-help-2.37-22.u6.fos23.aarch64.rpm FusionOS-SA-2023-2212 Low FusionOS CVE-2015-1197:cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive. FusionOS cpio-2.13-10.u2.fos23.x86_64.rpm cpio-help-2.13-10.u2.fos23.noarch.rpm cpio-2.13-10.u2.fos23.aarch64.rpm FusionOS-SA-2023-2213 Moderate FusionOS CVE-2022-48554:File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project. FusionOS file-5.41-3.u1.fos23.x86_64.rpm file-libs-5.41-3.u1.fos23.x86_64.rpm file-devel-5.41-3.u1.fos23.x86_64.rpm file-help-5.41-3.u1.fos23.x86_64.rpm python3-magic-5.41-3.u1.fos23.noarch.rpm file-5.41-3.u1.fos23.aarch64.rpm file-libs-5.41-3.u1.fos23.aarch64.rpm file-devel-5.41-3.u1.fos23.aarch64.rpm file-help-5.41-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2214 Important FusionOS CVE-2020-22219:Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to run arbitrary code via crafted input to the encoder. FusionOS flac-1.3.4-2.u1.fos23.x86_64.rpm flac-devel-1.3.4-2.u1.fos23.x86_64.rpm xmms-flac-1.3.4-2.u1.fos23.x86_64.rpm flac-help-1.3.4-2.u1.fos23.x86_64.rpm flac-1.3.4-2.u1.fos23.aarch64.rpm flac-devel-1.3.4-2.u1.fos23.aarch64.rpm xmms-flac-1.3.4-2.u1.fos23.aarch64.rpm flac-help-1.3.4-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2215 Low FusionOS CVE-2023-4156:A heap out of bound read issue exists in builtin.c of gawk prior to version 5.1.1. The array the_args takes an unsafe index val , while it does not validate the index to ensure the index refers to a valid position in the array (e.g., exceedingly large or negative). The vulnerability can cause crash of the software and might be used by attackers to read sensitive information. FusionOS gawk-5.1.1-5.u2.fos23.x86_64.rpm gawk-devel-5.1.1-5.u2.fos23.x86_64.rpm gawk-help-5.1.1-5.u2.fos23.noarch.rpm gawk-lang-5.1.1-5.u2.fos23.x86_64.rpm gawk-5.1.1-5.u2.fos23.aarch64.rpm gawk-devel-5.1.1-5.u2.fos23.aarch64.rpm gawk-lang-5.1.1-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2216 Moderate FusionOS CVE-2023-39128:GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a stack overflow via the function ada_decode at /gdb/ada-lang.c. FusionOS gdb-11.1-6.u2.fos23.x86_64.rpm gdb-headless-11.1-6.u2.fos23.x86_64.rpm gdb-gdbserver-11.1-6.u2.fos23.x86_64.rpm gdb-help-11.1-6.u2.fos23.noarch.rpm gdb-11.1-6.u2.fos23.aarch64.rpm gdb-headless-11.1-6.u2.fos23.aarch64.rpm gdb-gdbserver-11.1-6.u2.fos23.aarch64.rpm FusionOS-SA-2023-2217 Moderate FusionOS CVE-2023-38559:A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN device with gs. FusionOS ghostscript-9.55.0-3.u2.fos23.x86_64.rpm ghostscript-devel-9.55.0-3.u2.fos23.x86_64.rpm ghostscript-help-9.55.0-3.u2.fos23.noarch.rpm ghostscript-tools-dvipdf-9.55.0-3.u2.fos23.x86_64.rpm ghostscript-9.55.0-3.u2.fos23.aarch64.rpm ghostscript-devel-9.55.0-3.u2.fos23.aarch64.rpm ghostscript-tools-dvipdf-9.55.0-3.u2.fos23.aarch64.rpm FusionOS-SA-2023-2218 Moderate FusionOS CVE-2023-29406:The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or FusionOS golang-1.20.5-3.u5.fos23.x86_64.rpm golang-help-1.20.5-3.u5.fos23.noarch.rpm golang-devel-1.20.5-3.u5.fos23.noarch.rpm golang-1.20.5-3.u5.fos23.aarch64.rpm FusionOS-SA-2023-2219 Important FusionOS CVE-2023-40225:HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request. FusionOS haproxy-2.6.6-4.u3.fos23.x86_64.rpm haproxy-help-2.6.6-4.u3.fos23.noarch.rpm haproxy-2.6.6-4.u3.fos23.aarch64.rpm FusionOS-SA-2023-2220 Moderate FusionOS CVE-2022-47022:An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via glibc-cpuset in topology-linux.c. FusionOS hwloc-2.7.1-2.u1.fos23.x86_64.rpm hwloc-devel-2.7.1-2.u1.fos23.x86_64.rpm hwloc-help-2.7.1-2.u1.fos23.x86_64.rpm hwloc-2.7.1-2.u1.fos23.aarch64.rpm hwloc-devel-2.7.1-2.u1.fos23.aarch64.rpm hwloc-help-2.7.1-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2221 Moderate FusionOS CVE-2023-40305:GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file. FusionOS indent-2.2.11-29.u1.fos23.x86_64.rpm indent-help-2.2.11-29.u1.fos23.noarch.rpm indent-2.2.11-29.u1.fos23.aarch64.rpm FusionOS-SA-2023-2222 Critical FusionOS CVE-2023-20593:An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. CVE-2023-4128:A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue. CVE-2023-4133:A use-after-free vulnerability was found in the cxgb4 driver in the Linux kernel. The bug occurs when the cxgb4 device is detaching due to a possible rearming of the flower_stats_timer from the work queue. This flaw allows a local user to crash the system, causing a denial of service condition. CVE-2023-4134:A use-after-free vulnerability was found in the cyttsp4_core driver in the Linux kernel. This issue occurs in the device cleanup routine due to a possible rearming of the watchdog_timer from the workqueue. This could allow a local user to crash the system, causing a denial of service. CVE-2023-4132:A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition. CVE-2023-3867:A vulnerability was found in Linux Kernel (Operating System) (the affected version is unknown). It has been rated as critical. Affected by this issue is an unknown code of the file fs/smb/server/smb2pdu.c of the component ksmbd. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CVE-2023-4147:A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system. CVE-2023-3772:A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. CVE-2023-3863:A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel. This flaw allows a local user with special privileges to impact a kernel information leak issue. CVE-2023-3611:An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. CVE-2023-38426:An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in smb2_find_context_vals when create_context's name_len is larger than the tag length. CVE-2023-3609:A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc. CVE-2023-21255:In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. CVE-2023-38428:An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly check the UserName value because it does not consider the address of security buffer, leading to an out-of-bounds read. CVE-2023-3776:A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f. CVE-2023-4004:A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system. CVE-2023-38427:An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu.c in ksmbd has an integer underflow and out-of-bounds read in deassemble_neg_contexts. CVE-2023-38429:An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c in ksmbd has an off-by-one error in memory allocation (because of ksmbd_smb2_check_message) that may lead to out-of-bounds access. CVE-2023-38430:An issue was discovered in the Linux kernel before 6.3.9. ksmbd does not validate the SMB request protocol ID, leading to an out-of-bounds read. FusionOS kernel-5.10.0-136.46.0.124.u73.fos23.x86_64.rpm kernel-headers-5.10.0-136.46.0.124.u73.fos23.x86_64.rpm kernel-devel-5.10.0-136.46.0.124.u73.fos23.x86_64.rpm kernel-tools-5.10.0-136.46.0.124.u73.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.46.0.124.u73.fos23.x86_64.rpm perf-5.10.0-136.46.0.124.u73.fos23.x86_64.rpm python3-perf-5.10.0-136.46.0.124.u73.fos23.x86_64.rpm bpftool-5.10.0-136.46.0.124.u73.fos23.x86_64.rpm kernel-5.10.0-136.46.0.124.u73.fos23.aarch64.rpm kernel-headers-5.10.0-136.46.0.124.u73.fos23.aarch64.rpm kernel-devel-5.10.0-136.46.0.124.u73.fos23.aarch64.rpm kernel-tools-5.10.0-136.46.0.124.u73.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.46.0.124.u73.fos23.aarch64.rpm perf-5.10.0-136.46.0.124.u73.fos23.aarch64.rpm python3-perf-5.10.0-136.46.0.124.u73.fos23.aarch64.rpm bpftool-5.10.0-136.46.0.124.u73.fos23.aarch64.rpm FusionOS-SA-2023-2223 Moderate FusionOS CVE-2023-36054:lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count. FusionOS krb5-1.19.2-9.u2.fos23.x86_64.rpm krb5-server-1.19.2-9.u2.fos23.x86_64.rpm krb5-client-1.19.2-9.u2.fos23.x86_64.rpm krb5-devel-1.19.2-9.u2.fos23.x86_64.rpm krb5-libs-1.19.2-9.u2.fos23.x86_64.rpm krb5-help-1.19.2-9.u2.fos23.noarch.rpm krb5-1.19.2-9.u2.fos23.aarch64.rpm krb5-server-1.19.2-9.u2.fos23.aarch64.rpm krb5-client-1.19.2-9.u2.fos23.aarch64.rpm krb5-devel-1.19.2-9.u2.fos23.aarch64.rpm krb5-libs-1.19.2-9.u2.fos23.aarch64.rpm FusionOS-SA-2023-2224 Moderate FusionOS CVE-2023-38633:A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element. FusionOS librsvg2-2.50.5-6.u3.fos23.x86_64.rpm librsvg2-devel-2.50.5-6.u3.fos23.x86_64.rpm librsvg2-tools-2.50.5-6.u3.fos23.x86_64.rpm librsvg2-help-2.50.5-6.u3.fos23.noarch.rpm librsvg2-2.50.5-6.u3.fos23.aarch64.rpm librsvg2-devel-2.50.5-6.u3.fos23.aarch64.rpm librsvg2-tools-2.50.5-6.u3.fos23.aarch64.rpm FusionOS-SA-2023-2225 Moderate FusionOS CVE-2022-40090:An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file. CVE-2023-3618:A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service. FusionOS libtiff-4.3.0-32.u8.fos23.x86_64.rpm libtiff-devel-4.3.0-32.u8.fos23.x86_64.rpm libtiff-static-4.3.0-32.u8.fos23.x86_64.rpm libtiff-tools-4.3.0-32.u8.fos23.x86_64.rpm libtiff-help-4.3.0-32.u8.fos23.noarch.rpm libtiff-4.3.0-32.u8.fos23.aarch64.rpm libtiff-devel-4.3.0-32.u8.fos23.aarch64.rpm libtiff-static-4.3.0-32.u8.fos23.aarch64.rpm libtiff-tools-4.3.0-32.u8.fos23.aarch64.rpm FusionOS-SA-2023-2226 Critical FusionOS CVE-2022-48522:In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation. FusionOS perl-5.34.0-9.u3.fos23.x86_64.rpm perl-libs-5.34.0-9.u3.fos23.x86_64.rpm perl-devel-5.34.0-9.u3.fos23.x86_64.rpm perl-help-5.34.0-9.u3.fos23.noarch.rpm perl-5.34.0-9.u3.fos23.aarch64.rpm perl-libs-5.34.0-9.u3.fos23.aarch64.rpm perl-devel-5.34.0-9.u3.fos23.aarch64.rpm FusionOS-SA-2023-2227 Moderate FusionOS CVE-2023-3301:A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a denial of service. CVE-2023-3180:A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ. FusionOS qemu-6.2.0-79.u7.fos23.x86_64.rpm qemu-guest-agent-6.2.0-79.u7.fos23.x86_64.rpm qemu-help-6.2.0-79.u7.fos23.noarch.rpm qemu-img-6.2.0-79.u7.fos23.x86_64.rpm qemu-block-rbd-6.2.0-79.u7.fos23.x86_64.rpm qemu-block-ssh-6.2.0-79.u7.fos23.x86_64.rpm qemu-block-iscsi-6.2.0-79.u7.fos23.x86_64.rpm qemu-block-curl-6.2.0-79.u7.fos23.x86_64.rpm qemu-hw-usb-host-6.2.0-79.u7.fos23.x86_64.rpm qemu-seabios-6.2.0-79.u7.fos23.x86_64.rpm qemu-system-aarch64-6.2.0-79.u7.fos23.x86_64.rpm qemu-system-arm-6.2.0-79.u7.fos23.x86_64.rpm qemu-system-x86_64-6.2.0-79.u7.fos23.x86_64.rpm qemu-system-riscv-6.2.0-79.u7.fos23.x86_64.rpm qemu-6.2.0-79.u7.fos23.aarch64.rpm qemu-guest-agent-6.2.0-79.u7.fos23.aarch64.rpm qemu-img-6.2.0-79.u7.fos23.aarch64.rpm qemu-block-rbd-6.2.0-79.u7.fos23.aarch64.rpm qemu-block-ssh-6.2.0-79.u7.fos23.aarch64.rpm qemu-block-iscsi-6.2.0-79.u7.fos23.aarch64.rpm qemu-block-curl-6.2.0-79.u7.fos23.aarch64.rpm qemu-hw-usb-host-6.2.0-79.u7.fos23.aarch64.rpm qemu-system-aarch64-6.2.0-79.u7.fos23.aarch64.rpm qemu-system-arm-6.2.0-79.u7.fos23.aarch64.rpm qemu-system-x86_64-6.2.0-79.u7.fos23.aarch64.rpm qemu-system-riscv-6.2.0-79.u7.fos23.aarch64.rpm FusionOS-SA-2023-2228 Important FusionOS CVE-2021-25786:An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter in libqpdf. FusionOS qpdf-8.4.2-4.u1.fos23.x86_64.rpm qpdf-devel-8.4.2-4.u1.fos23.x86_64.rpm qpdf-help-8.4.2-4.u1.fos23.noarch.rpm qpdf-8.4.2-4.u1.fos23.aarch64.rpm qpdf-devel-8.4.2-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2229 Moderate FusionOS CVE-2023-32573:In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled. FusionOS qt-4.8.7-53.u2.fos23.x86_64.rpm qt-devel-4.8.7-53.u2.fos23.x86_64.rpm qt-4.8.7-53.u2.fos23.aarch64.rpm qt-devel-4.8.7-53.u2.fos23.aarch64.rpm FusionOS-SA-2023-2230 Important FusionOS CVE-2022-24834:Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20. FusionOS redis5-5.0.7-6.u4.fos23.x86_64.rpm redis5-devel-5.0.7-6.u4.fos23.x86_64.rpm redis5-doc-5.0.7-6.u4.fos23.noarch.rpm redis5-5.0.7-6.u4.fos23.aarch64.rpm redis5-devel-5.0.7-6.u4.fos23.aarch64.rpm FusionOS-SA-2023-2231 Important FusionOS CVE-2022-24834:Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20. FusionOS redis6-6.2.7-3.u4.fos23.x86_64.rpm redis6-devel-6.2.7-3.u4.fos23.x86_64.rpm redis6-doc-6.2.7-3.u4.fos23.noarch.rpm redis6-6.2.7-3.u4.fos23.aarch64.rpm redis6-devel-6.2.7-3.u4.fos23.aarch64.rpm FusionOS-SA-2023-2232 Moderate FusionOS CVE-2023-2157:A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing. CVE-2023-3195:A stack-based buffer overflow issue was found in ImageMagick's coders/tiff.c. This flaw allows an attacker to trick the user into opening a specially crafted malicious tiff file, causing an application to crash, resulting in a denial of service. FusionOS ImageMagick-7.1.1.8-4.u5.fos23.x86_64.rpm ImageMagick-devel-7.1.1.8-4.u5.fos23.x86_64.rpm ImageMagick-help-7.1.1.8-4.u5.fos23.x86_64.rpm ImageMagick-perl-7.1.1.8-4.u5.fos23.x86_64.rpm ImageMagick-c++-7.1.1.8-4.u5.fos23.x86_64.rpm ImageMagick-c++-devel-7.1.1.8-4.u5.fos23.x86_64.rpm ImageMagick-7.1.1.8-4.u5.fos23.aarch64.rpm ImageMagick-devel-7.1.1.8-4.u5.fos23.aarch64.rpm ImageMagick-help-7.1.1.8-4.u5.fos23.aarch64.rpm ImageMagick-perl-7.1.1.8-4.u5.fos23.aarch64.rpm ImageMagick-c++-7.1.1.8-4.u5.fos23.aarch64.rpm ImageMagick-c++-devel-7.1.1.8-4.u5.fos23.aarch64.rpm FusionOS-SA-2023-2233 Moderate FusionOS CVE-2021-37533:Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. FusionOS apache-commons-net-3.6-6.u2.fos23.noarch.rpm apache-commons-net-help-3.6-6.u2.fos23.noarch.rpm FusionOS-SA-2023-2234 Important FusionOS CVE-2022-38398:Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14. CVE-2022-38648:Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14. CVE-2022-40146:Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14. CVE-2022-44729:Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later. CVE-2022-44730:Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL. FusionOS batik-1.10-8.u2.fos23.noarch.rpm batik-help-1.10-8.u2.fos23.noarch.rpm FusionOS-SA-2023-2235 Important FusionOS CVE-2022-47007:An issue was discovered function stab_demangle_v3_arg in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. CVE-2022-47010:An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. CVE-2022-48063:GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function load_separate_debug_files at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack. CVE-2022-44840:Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c. CVE-2022-47695:An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function bfd_mach_o_get_synthetic_symtab in match-o.c. CVE-2022-48065:GNU Binutils before 2.40 was discovered to contain a memory leak vulnerability var the function find_abstract_instance in dwarf2.c. FusionOS binutils-2.37-24.u10.fos23.x86_64.rpm binutils-devel-2.37-24.u10.fos23.x86_64.rpm binutils-help-2.37-24.u10.fos23.x86_64.rpm binutils-2.37-24.u10.fos23.aarch64.rpm binutils-devel-2.37-24.u10.fos23.aarch64.rpm binutils-help-2.37-24.u10.fos23.aarch64.rpm FusionOS-SA-2023-2236 Critical FusionOS CVE-2022-48174:There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution. FusionOS busybox-1.34.1-19.u1.fos23.x86_64.rpm busybox-petitboot-1.34.1-19.u1.fos23.x86_64.rpm busybox-help-1.34.1-19.u1.fos23.x86_64.rpm busybox-1.34.1-19.u1.fos23.aarch64.rpm busybox-petitboot-1.34.1-19.u1.fos23.aarch64.rpm busybox-help-1.34.1-19.u1.fos23.aarch64.rpm FusionOS-SA-2023-2237 Important FusionOS CVE-2023-20197:A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for completion when a file is decompressed, which may result in a loop condition that could cause the affected software to stop responding. An attacker could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to stop responding, resulting in a DoS condition on the affected software and consuming available system resources. For a description of this vulnerability, see the ClamAV blog . FusionOS clamav-0.103.9-1.fos23.x86_64.rpm clamav-devel-0.103.9-1.fos23.x86_64.rpm clamav-help-0.103.9-1.fos23.x86_64.rpm clamav-filesystem-0.103.9-1.fos23.noarch.rpm clamav-data-0.103.9-1.fos23.noarch.rpm clamav-update-0.103.9-1.fos23.x86_64.rpm clamd-0.103.9-1.fos23.x86_64.rpm clamav-milter-0.103.9-1.fos23.x86_64.rpm clamav-0.103.9-1.fos23.aarch64.rpm clamav-devel-0.103.9-1.fos23.aarch64.rpm clamav-help-0.103.9-1.fos23.aarch64.rpm clamav-update-0.103.9-1.fos23.aarch64.rpm clamd-0.103.9-1.fos23.aarch64.rpm clamav-milter-0.103.9-1.fos23.aarch64.rpm FusionOS-SA-2023-2238 Moderate FusionOS CVE-2021-46310:An issue was discovered IW44Image.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero. CVE-2021-46312:An issue was discovered IW44EncodeCodec.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero. FusionOS djvulibre-3.5.27-19.u1.fos23.x86_64.rpm djvulibre-devel-3.5.27-19.u1.fos23.x86_64.rpm djvulibre-help-3.5.27-19.u1.fos23.x86_64.rpm djvulibre-3.5.27-19.u1.fos23.aarch64.rpm djvulibre-devel-3.5.27-19.u1.fos23.aarch64.rpm djvulibre-help-3.5.27-19.u1.fos23.aarch64.rpm FusionOS-SA-2023-2239 Critical FusionOS CVE-2020-15663:If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled back to a previous version which would have allowed exploitation of an older bug and arbitrary code execution with System Privileges. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, and Firefox ESR < 78.2. CVE-2020-15664:By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious extension being installed. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, Firefox ESR < 78.2, and Firefox for Android < 80. CVE-2020-15665:Firefox did not reset the address bar after the beforeunload dialog was shown if the user chose to remain on the page. This could have resulted in an incorrect URL being shown when used in conjunction with other unexpected browser behaviors. This vulnerability affects Firefox < 80. CVE-2020-15666:When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message. This level of information leakage is inconsistent with the standardized onerror/onsuccess disclosure and can lead to inferring login status to services or device discovery on a local network among other attacks. This vulnerability affects Firefox < 80 and Firefox for Android < 80. CVE-2020-15667:When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap overflow, leading to memory corruption and potentially arbitrary code execution. Within Firefox as released by Mozilla, this issue is only exploitable with the Mozilla-controlled signing key. This vulnerability affects Firefox < 80. CVE-2020-15668:A lock was missing when accessing a data structure and importing certificate information into the trust database. This vulnerability affects Firefox < 80 and Firefox for Android < 80. CVE-2020-15670:Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 80, Firefox ESR < 78.2, Thunderbird < 78.2, and Firefox for Android < 80. CVE-2020-15673:Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. CVE-2020-15674:Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 81. CVE-2020-15675:When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 81. CVE-2020-15676:Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. CVE-2020-15677:By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. CVE-2020-15678:When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the function APZCTreeManager::ComputeClippedCompositionBounds did not follow iterator invalidation rules. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. CVE-2020-15680:If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken image size of a non-existent protocol handler. This allowed an attacker to successfully probe whether an external protocol handler was registered. This vulnerability affects Firefox < 82. CVE-2020-15681:When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could have overwritten another's entry in a shared stub table, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 82. CVE-2020-15682:When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An attacker could induce that prompt to be associated with an origin they didn't control, resulting in a spoofing attack. This was fixed by changing external protocol prompts to be tab-modal while also ensuring they could not be incorrectly associated with a different origin. This vulnerability affects Firefox < 82. CVE-2020-15683:Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4, Firefox < 82, and Thunderbird < 78.4. CVE-2020-15684:Mozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 82. CVE-2020-16012:Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page. CVE-2020-16044:Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet. CVE-2020-26950:In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. This vulnerability affects Firefox < 82.0.3, Firefox ESR < 78.4.1, and Thunderbird < 78.4.2. CVE-2020-26951:A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal pages could have used this attack to bypass our built-in sanitizer. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. CVE-2020-26953:It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or otherwise confuse the user. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. CVE-2020-26956:In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. CVE-2020-26958:Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. CVE-2020-26959:During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. CVE-2020-26960:If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. CVE-2020-26961:When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver. However when an IPv4 address was mapped through IPv6, these addresses were erroneously let through, leading to a potential DNS Rebinding attack. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. CVE-2020-26962:Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated. This could have been used in clickjacking attacks, as well as be read across partitions in dynamic first party isolation. This vulnerability affects Firefox < 83. CVE-2020-26965:Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when using a software keyboard that remembers user input, a user typed their password and used that feature, the type of the password field was changed, resulting in a keyboard layout change and the possibility for the software keyboard to remember the typed password. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. CVE-2020-26966:Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; resulting in an information leak. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. CVE-2020-26968:Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. CVE-2020-26969:Mozilla developers reported memory safety bugs present in Firefox 82. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 83. CVE-2020-26971:Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. CVE-2020-26972:The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they are not attempting to use a dead actor they have a reference to. Such a check was omitted in WebGL, resulting in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 84. CVE-2020-26973:Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. CVE-2020-26974:When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. CVE-2020-26976:When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the (insecure) framing. This vulnerability affects Firefox < 84. CVE-2020-26978:Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. CVE-2020-26979:When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event and then redirect the user before navigation occurred to the desired, entered address. To construct a convincing spoof the attacker would have had to guess what the user was typing, perhaps by suggesting it. This vulnerability affects Firefox < 84. CVE-2020-35111:When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening View Source could have inadvertently leaked their IP address. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. CVE-2020-35113:Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. CVE-2020-35114:Mozilla developers reported memory safety bugs present in Firefox 83. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 84. CVE-2021-23953:If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. CVE-2021-23954:Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. CVE-2021-23955:The browser could have been confused into transferring a pointer lock state into another tab, which could have lead to clickjacking attacks. This vulnerability affects Firefox < 85. CVE-2021-23956:An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory. This was addressed by adding a new prompt. This vulnerability affects Firefox < 85. CVE-2021-23958:The browser could have been confused into transferring a screen sharing state into another tab, which would leak unintended information. This vulnerability affects Firefox < 85. CVE-2021-23960:Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. CVE-2021-23961:Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox < 85. CVE-2021-23962:Incorrect use of the '<RowCountChanged>' method could have led to a user-after-poison and a potentially exploitable crash. This vulnerability affects Firefox < 85. CVE-2021-23963:When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to loss of control over the currently granted permission. This vulnerability affects Firefox < 85. CVE-2021-23964:Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. CVE-2021-23965:Mozilla developers reported memory safety bugs present in Firefox 84. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 85. CVE-2021-23968:If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. CVE-2021-23969:As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. CVE-2021-23970:Context-specific code was included in a shared jump table; resulting in assertions being triggered in multithreaded wasm code. This vulnerability affects Firefox < 86. CVE-2021-23971:When processing a redirect with a conflicting Referrer-Policy, Firefox would have adopted the redirect's Referrer-Policy. This would have potentially resulted in more information than intended by the original origin being provided to the destination of the redirect. This vulnerability affects Firefox < 86. CVE-2021-23972:One phishing tactic on the web is to provide a link with HTTP Auth. For example 'https://www.phishingtarget.com@evil.com'. To mitigate this type of attack, Firefox will display a warning dialog; however, this warning dialog would not have been displayed if evil.com used a redirect that was cached by the browser. This vulnerability affects Firefox < 86. CVE-2021-23973:When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed information about the resource. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. CVE-2021-23974:The DOMParser API did not properly process '<noscript>' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox < 86. CVE-2021-23975:The developer page about:memory has a Measure function for exploring what object types the browser has allocated and their sizes. When this function was invoked we incorrectly called the sizeof function, instead of using the API method that checks for invalid pointers. This vulnerability affects Firefox < 86. CVE-2021-23978:Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. CVE-2021-23979:Mozilla developers reported memory safety bugs present in Firefox 85. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 86. CVE-2021-23981:A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9. CVE-2021-23982:Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on the user's local machine utilizing WebRTC connections. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9. CVE-2021-23983:By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could have been applied, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 87. CVE-2021-23984:A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fully controllable, but in this situation was. This could have been used to spoof a website and attempt to trick the user into providing credentials. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9. CVE-2021-23985:If an attacker is able to alter specific about:config values (for example malware running on the user's computer), the Devtools remote debugging feature could have been enabled in a way that was unnoticable to the user. This would have allowed a remote attacker (able to make a direct network connection to the victim) to monitor the user's browsing activity and (plaintext) network traffic. This was addressed by providing a visual cue when Devtools has an open network socket. This vulnerability affects Firefox < 87. CVE-2021-23986:A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL. The response to this cross-origin request could have been read by the extension, allowing a same-origin policy bypass by the extension, which should not have cross-origin permissions. This cross-origin request was made without cookies, so the sensitive information disclosed by the violation was limited to local-network resources or resources that perform IP-based authentication. This vulnerability affects Firefox < 87. CVE-2021-23987:Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9. CVE-2021-23988:Mozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 87. CVE-2021-23994:A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. CVE-2021-23995:When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. CVE-2021-23996:By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofing attack that could have been used for phishing or other attacks on a user. This vulnerability affects Firefox < 88. CVE-2021-23997:Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. We presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox < 88. CVE-2021-23998:Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. CVE-2021-23999:If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. CVE-2021-24000:A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they were on a separate tab. In conjunction with certain elements (such as &lt;input type="file"&gt;) this could have led to an attack where a user was confused about the origin of the webpage and potentially disclosed information they did not intend to. This vulnerability affects Firefox < 88. CVE-2021-24001:A compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructure that was not restricted to testing-only configurations. This vulnerability affects Firefox < 88. CVE-2021-24002:When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and allowed arbitrary commands to be sent to the FTP server. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. CVE-2021-29944:Lack of escaping allowed HTML injection when a webpage was viewed in Reader View. While a Content Security Policy prevents direct code execution, HTML injection is still possible. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 88. CVE-2021-29945:The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash. *Note: This issue only affected x86-32 platforms. Other platforms are unaffected.*. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. CVE-2021-29946:Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. CVE-2021-29947:Mozilla developers and community members reported memory safety bugs present in Firefox 87. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 88. CVE-2021-29952:When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code. This vulnerability affects Firefox < 88.0.1 and Firefox for Android < 88.1.3. CVE-2021-29953:A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domain, resulting in a Universal Cross-Site Scripting vulnerability. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected. Further details are being temporarily withheld to allow users an opportunity to update.*. This vulnerability affects Firefox < 88.0.1 and Firefox for Android < 88.1.3. CVE-2021-29955:A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. (A related vulnerability, Speculative Code Store Bypass (SCSB), did not affect Firefox.). This vulnerability affects Firefox ESR < 78.9 and Firefox < 87. CVE-2021-29959:When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prevent the website from re-enabling it without an additional prompt. This was only possible if the website kept recording with the microphone until re-enabling the camera. This vulnerability affects Firefox < 89. CVE-2021-29960:Firefox used to cache the last filename used for printing a file. When generating a filename for printing, Firefox usually suggests the web page title. The caching and suggestion techniques combined may have lead to the title of a website visited during private browsing mode being stored on disk. This vulnerability affects Firefox < 89. CVE-2021-29961:When styling and rendering an oversized `<select>` element, Firefox did not apply correct clipping which allowed an attacker to paint over the user interface. This vulnerability affects Firefox < 89. CVE-2021-29964:A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11. CVE-2021-29965:A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently active website instead of the website that triggered the dialog. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89. CVE-2021-29966:Mozilla developers reported memory safety bugs present in Firefox 88. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 89. CVE-2021-29967:Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11. CVE-2021-29970:A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. *This bug could only be triggered when accessibility was enabled.*. This vulnerability affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90. CVE-2021-29972:A use-after-free vulnerability was found via testing, and traced to an out-of-date Cairo library. Updating the library resolved the issue, and may have remediated other, unknown security vulnerabilities as well. This vulnerability affects Firefox < 90. CVE-2021-29974:When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page would allow the user to override an error on a domain which had specified HTTP Strict Transport Security (which implies that the error should not be override-able.) This issue did not affect the network connections, and they were correctly upgraded to HTTPS automatically. This vulnerability affects Firefox < 90. CVE-2021-29975:Through a series of DOM manipulations, a message, over which the attacker had control of the text but not HTML or formatting, could be overlaid on top of another domain (with the new domain correctly shown in the address bar) resulting in possible user confusion. This vulnerability affects Firefox < 90. CVE-2021-29976:Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90. CVE-2021-29977:Mozilla developers reported memory safety bugs present in Firefox 89. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 90. CVE-2021-29980:Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. CVE-2021-29981:An issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures in JITted code that would lead to a potentially exploitable crash. This vulnerability affects Firefox < 91 and Thunderbird < 91. CVE-2021-29982:Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a single bit of memory. This vulnerability affects Firefox < 91 and Thunderbird < 91. CVE-2021-29984:Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection. This led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. CVE-2021-29985:A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. CVE-2021-29986:A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash. *Note: This issue only affected Linux operating systems. Other operating systems are unaffected.* This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. CVE-2021-29987:After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still record a click in the default location, making it possible to trick a user into accepting a permission they did not want to. *This bug only affects Firefox on Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox < 91 and Thunderbird < 91. CVE-2021-29988:Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. CVE-2021-29989:Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.13, Firefox ESR < 78.13, and Firefox < 91. CVE-2021-29990:Mozilla developers and community members reported memory safety bugs present in Firefox 90. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 91. CVE-2021-29991:Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers. This allowed for a header splitting attack against servers using HTTP/3. This vulnerability affects Firefox < 91.0.1 and Thunderbird < 91.0.1. CVE-2021-30547:Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. CVE-2021-32810:crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a logical bug. Crates using `Stealer::steal`, `Stealer::steal_batch`, or `Stealer::steal_batch_and_pop` are affected by this issue. This has been fixed in crossbeam-deque 0.8.1 and 0.7.4. CVE-2021-38491:Mixed-content checks were unable to analyze opaque origins which led to some mixed content being loaded. This vulnerability affects Firefox < 92. CVE-2021-38493:Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.14, Thunderbird < 78.14, and Firefox < 92. CVE-2021-38494:Mozilla developers reported memory safety bugs present in Firefox 91. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 92. CVE-2021-38496:During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.15, Thunderbird < 91.2, Firefox ESR < 91.2, Firefox ESR < 78.15, and Firefox < 93. CVE-2021-38497:Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to possible user confusion and spoofing attacks. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2. CVE-2021-38498:During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2. CVE-2021-38499:Mozilla developers reported memory safety bugs present in Firefox 92. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 93. CVE-2021-38500:Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.15, Thunderbird < 91.2, Firefox ESR < 91.2, Firefox ESR < 78.15, and Firefox < 93. CVE-2021-38501:Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2. CVE-2021-38503:The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. CVE-2021-38504:When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have resulted, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. CVE-2021-38505:Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it available on other computers in certain scenarios. Applications that wish to prevent copied data from being recorded in Cloud History must use specific clipboard formats; and Firefox before versions 94 and ESR 91.3 did not implement them. This could have caused sensitive data to be recorded to a user's Microsoft account. *This bug only affects Firefox for Windows 10+ with Cloud Clipboard enabled. Other operating systems are unaffected.*. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. CVE-2021-38506:Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on the browser UI including phishing. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. CVE-2021-38507:The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while retaining the visual properties of an HTTP connection, including being same-origin with unencrypted connections on port 80. However, if a second encrypted port on the same IP address (e.g. port 8443) did not opt-in to opportunistic encryption; a network attacker could forward a connection from the browser to port 443 to port 8443, causing the browser to treat the content of port 8443 as same-origin with HTTP. This was resolved by disabling the Opportunistic Encryption feature, which had low usage. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. CVE-2021-38508:By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message could have obscured the prompt, resulting in the user potentially being tricked into granting the permission. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. CVE-2021-38509:Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed over top an uncontrolled webpage of the attacker's choosing. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. CVE-2021-38510:The executable file warning was not presented when downloading .inetloc files, which, due to a flaw in Mac OS, can run commands on a user's computer.*Note: This issue only affected Mac OS operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. CVE-2021-4140:It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2021-43531:When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect URL of the element clicked. If the Web Extension lacked the WebRequest permission for the hosts involved in the redirect, this would be a same-origin-violation leaking data the Web Extension should have access to. This was fixed to provide the pre-redirect URL. This is related to CVE-2021-43532 but in the context of Web Extensions. This vulnerability affects Firefox < 94. CVE-2021-43532:The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows - in conjunction with a Content Security Policy that stopped a redirection chain in the middle - the final image URL could be one that contained an authentication token used to takeover a user account. If a website tricked a user into copy and pasting the image link back to the page, the page would be able to steal the authentication tokens. This was fixed by making the action return the original URL, before any redirects. This vulnerability affects Firefox < 94. CVE-2021-43533:When parsing internationalized domain names, high bits of the characters in the URLs were sometimes stripped, resulting in inconsistencies that could lead to user confusion or attacks such as phishing. This vulnerability affects Firefox < 94. CVE-2021-43534:Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. CVE-2021-43535:A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 93, Thunderbird < 91.3, and Firefox ESR < 91.3. CVE-2021-43536:Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43537:An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43538:By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43539:Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing those live pointers. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43540:WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that would not have been uninstalled with the extension. This vulnerability affects Firefox < 95. CVE-2021-43541:When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43542:Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43543:Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43545:Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43546:It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2022-0511:Mozilla developers and community members Gabriele Svelto, Sebastian Hengst, Randell Jesup, Luan Herrera, Lars T Hansen, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 97. CVE-2022-0843:Mozilla developers Kershaw Chang, Ryan VanderMeulen, and Randell Jesup reported memory safety bugs present in Firefox 97. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 98. CVE-2022-1097:<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. CVE-2022-1196:After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8 and Firefox ESR < 91.8. CVE-2022-1529:An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the privileged parent process. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1. CVE-2022-1802:If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1. CVE-2022-1919:Use after free in Codecs in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-2200:If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code execution. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. CVE-2022-22737:Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2022-22738:Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2022-22739:Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2022-22740:Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2022-22741:When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2022-22742:When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2022-22743:When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2022-22745:Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2022-22747:After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2022-22748:Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL protocol. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2022-22753:A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM access.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. CVE-2022-22754:If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so, bypass the prompt which grants the new version the new requested permissions. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. CVE-2022-22755:By using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute JavaScript (within the bounds of the same-origin policy) even after the tab was closed. This vulnerability affects Firefox < 97. CVE-2022-22756:If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after the user clicked on it. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. CVE-2022-22757:Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to control it. <br>*This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.*. This vulnerability affects Firefox < 97. CVE-2022-22759:If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have run despite the iframe's sandbox. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. CVE-2022-22760:When importing resources using Web Workers, error messages would distinguish the difference between <code>application/javascript</code> responses and non-script responses. This could have been abused to learn information cross-origin. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. CVE-2022-22761:Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. CVE-2022-22763:When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. This vulnerability affects Firefox < 96, Thunderbird < 91.6, and Firefox ESR < 91.6. CVE-2022-24713:regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API. Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes. CVE-2022-26381:An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploitable crash. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7. CVE-2022-26382:While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fonts. Side-channel attacks on the text by using specially crafted fonts could have lead to this text being inferred by the webpage. This vulnerability affects Firefox < 98. CVE-2022-26383:When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7. CVE-2022-26384:If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a link that, when clicked, would lead to JavaScript execution in violation of the sandbox. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7. CVE-2022-26385:In unusual circumstances, an individual thread may outlive the thread's manager during shutdown. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 98. CVE-2022-26386:Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>, but this behavior was changed to download them to <code>/tmp</code> where they could be affected by other local users. This behavior was reverted to the original, user-specific directory. <br>*This bug only affects Firefox for macOS and Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.7 and Thunderbird < 91.7. CVE-2022-26387:When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7. CVE-2022-26485:Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0. CVE-2022-26486:An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0. CVE-2022-28281:If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. CVE-2022-28282:By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object during JavaScript execution and then referencing the object through a freed pointer, leading to a potential exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. CVE-2022-28283:The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include local files or other files that should have been inaccessible. This vulnerability affects Firefox < 99. CVE-2022-28284:SVG's <code>&lt;use&gt;</code> element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to allow this, other browsers do not, and web developers relied on this property for script security so gecko's implementation was aligned with theirs. This vulnerability affects Firefox < 99. CVE-2022-28285:When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used. In conjunction with another vulnerability this could have been used for an out of bounds memory read. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. CVE-2022-28286:Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. CVE-2022-28287:In unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. This vulnerability affects Firefox < 99. CVE-2022-28289:Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 91.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. CVE-2022-29909:Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. CVE-2022-29911:An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code> being present. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. CVE-2022-29912:Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. CVE-2022-29914:When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. CVE-2022-29915:The Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects. This vulnerability affects Firefox < 100. CVE-2022-29916:Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. This could have been used to probe the browser history. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. CVE-2022-29918:Mozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 100. CVE-2022-31736:A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. CVE-2022-31737:A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. CVE-2022-31738:When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. CVE-2022-31740:On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. CVE-2022-31741:A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. CVE-2022-31742:An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles and cross-origin key handles. This could have led to cross-origin account linking in violation of WebAuthn goals. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. CVE-2022-31743:Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. This could have been used to escape HTML comments on pages that put user-controlled data in them. This vulnerability affects Firefox < 101. CVE-2022-31744:An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy. This vulnerability affects Firefox ESR < 91.11, Thunderbird < 102, Thunderbird < 91.11, and Firefox < 101. CVE-2022-31745:If array shift operations are not used, the Garbage Collector may have become confused about valid objects. This vulnerability affects Firefox < 101. CVE-2022-31748:Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 101. CVE-2022-3266:An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. CVE-2022-34468:An iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. CVE-2022-34469:When a TLS Certificate error occurs on a domain protected by the HSTS header, the browser should not allow the user to bypass the certificate error. On Firefox for Android, the user was presented with the option to bypass the error; this could only have been done by the user explicitly. <br>*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 102. CVE-2022-34470:Session history navigations may have led to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. CVE-2022-34471:When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest. If the manifest had been tampered with on the server, an attacker could trick the browser into downgrading the addon to a prior version. This vulnerability affects Firefox < 102. CVE-2022-34472:If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrect error pages being shown. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. CVE-2022-34473:The HTML Sanitizer should have sanitized the <code>href</code> attribute of SVG <code>&lt;use&gt;</code> tags; however it incorrectly did not sanitize <code>xlink:href</code> attributes. This vulnerability affects Firefox < 102. CVE-2022-34474:Even when an iframe was sandboxed with <code>allow-top-navigation-by-user-activation</code>, if it received a redirect header to an external protocol the browser would process the redirect and prompt the user as appropriate. This vulnerability affects Firefox < 102. CVE-2022-34475:SVG <code>&lt;use&gt;</code> tags that referenced a same-origin document could have resulted in script execution if attacker input was sanitized via the HTML Sanitizer API. This would have required the attacker to reference a same-origin JavaScript file containing the script to be executed. This vulnerability affects Firefox < 102. CVE-2022-34476:ASN.1 parsing of an indefinite SEQUENCE inside an indefinite GROUP could have resulted in the parser accepting malformed ASN.1. This vulnerability affects Firefox < 102. CVE-2022-34477:The MediaError message property should be consistent to avoid leaking information about cross-origin resources; however for a same-site cross-origin resource, the message could have leaked information enabling XS-Leaks attacks. This vulnerability affects Firefox < 102. CVE-2022-34479:A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing attacks. <br>*This bug only affects Thunderbird for Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. CVE-2022-34480:Within the <code>lg_init()</code> function, if several allocations succeed but then one fails, an uninitialized pointer would have been freed despite never being allocated. This vulnerability affects Firefox < 102. CVE-2022-34481:In the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have occurred when the number of elements to replace was too large for the container. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. CVE-2022-34482:An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from CVE-2022-34483. This vulnerability affects Firefox < 102. CVE-2022-34483:An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from CVE-2022-34482. This vulnerability affects Firefox < 102. CVE-2022-34484:The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. CVE-2022-34485:Mozilla developers Bryce Seager van Dyk and the Mozilla Fuzzing Team reported potential vulnerabilities present in Firefox 101. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 102. CVE-2022-36318:When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and Thunderbird < 91.12. CVE-2022-36319:When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed. This vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and Thunderbird < 91.12. CVE-2022-38472:An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into submitting data intended for the spoofed origin. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104. CVE-2022-38473:A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access). This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104. CVE-2022-38477:Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103 and Firefox ESR 102.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.2, Thunderbird < 102.2, and Firefox < 104. CVE-2022-38478:Members the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR 102.1, and Firefox ESR 91.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104. CVE-2022-40956:When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. CVE-2022-40957:Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<br>*This bug only affects Firefox on ARM64 platforms.*. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. CVE-2022-40958:By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context, leading to session fixation and other attacks. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. CVE-2022-40959:During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permissions into untrusted subdocuments. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. CVE-2022-40960:Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. CVE-2022-40962:Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 104 and Firefox ESR 102.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. CVE-2022-42928:Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have lead to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. CVE-2022-43680:In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. CVE-2022-45408:Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. CVE-2022-45409:The garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> may not have been called, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. CVE-2022-45410:When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec and then in browsers. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. CVE-2022-45411:Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript (such as cookies protected by HTTPOnly). To mitigate this attack, browsers placed limits on <code>fetch()</code> and XMLHttpRequest; however some webservers have implemented non-standard headers such as <code>X-Http-Method-Override</code> that override the HTTP method, and made this attack possible again. Thunderbird has applied the same mitigations to the use of this and similar headers. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. CVE-2022-45412:When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer. <br>*This bug only affects Thunderbird on Unix-based operated systems (Android, Linux, MacOS). Windows is unaffected.*. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. CVE-2022-45416:Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as Prime+Probe could have possibly figured out which keys were being pressed. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. CVE-2022-45418:If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. CVE-2022-45420:Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. CVE-2022-45421:Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. CVE-2022-46871:An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited. This vulnerability affects Firefox < 108. CVE-2022-46874:A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.<br/>*Note*: This issue was originally included in the advisories for Thunderbird 102.6, but a patch (specific to Thunderbird) was omitted, resulting in it actually being fixed in Thunderbird 102.6.1. This vulnerability affects Firefox < 108, Thunderbird < 102.6.1, Thunderbird < 102.6, and Firefox ESR < 102.6. CVE-2022-46875:The executable file warning was not presented when downloading .atloc and .ftploc files, which can run commands on a user's computer. <br>*Note: This issue only affected Mac OS operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6. CVE-2022-46878:Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6. CVE-2022-46882:A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnerability affects Firefox < 107, Firefox ESR < 102.6, and Thunderbird < 102.6. CVE-2023-0767:An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVE-2023-1945:Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 102.10 and Firefox ESR < 102.10. CVE-2023-1999:There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free. CVE-2023-23598:Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to <code>DataTransfer.setData</code>. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7. CVE-2023-23599:When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7. CVE-2023-23601:Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7. CVE-2023-23602:A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7. CVE-2023-23603:Regular expressions used to filter out forbidden properties and values from style directives in calls to <code>console.log</code> weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7. CVE-2023-25728:The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted URI when interaction with that iframe triggers a redirect. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVE-2023-25729:Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensions being able to open them without user interaction via <code>ExpandedPrincipals</code>. This could lead to further malicious actions such as downloading files or interacting with software already installed on the system. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVE-2023-25730:A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVE-2023-25732:When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not correctly calculated potentially leading to an out of bounds memory write. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVE-2023-25735:Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free after unwrapping the proxy. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVE-2023-25737:An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVE-2023-25739:Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in <code>ScriptLoadContext</code>. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVE-2023-25742:When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVE-2023-25751:Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. This could lead to a potentially exploitable crash. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. CVE-2023-25752:When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. This may have lead future code to be incorrect and vulnerable. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. CVE-2023-28162:While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have led to a potentially exploitable crash. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. CVE-2023-28164:Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. CVE-2023-28176:Mozilla developers Timothy Nikkel, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. CVE-2023-29531:An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash. *This bug only affects Firefox and Thunderbird for macOS. Other operating systems are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10. CVE-2023-29532:A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server. The update file can be replaced after the signature check, before the use, because the write-lock requested by the service does not work on a SMB server. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10. CVE-2023-29533:A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and <code>setInterval</code> calls. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. CVE-2023-29535:Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. CVE-2023-29536:An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. CVE-2023-29539:When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. CVE-2023-29541:Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commands. <br>*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. CVE-2023-29542:A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code. *This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10. CVE-2023-29545:Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user. *This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10. CVE-2023-29548:A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. CVE-2023-29550:Mozilla developers Randell Jesup, Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. CVE-2023-32205:In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. CVE-2023-32206:An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. CVE-2023-32207:A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. CVE-2023-32211:A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. CVE-2023-32212:An attacker could have positioned a <code>datalist</code> element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. CVE-2023-32213:When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. CVE-2023-32214:Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service. *Note: This attack only affects Windows. Other operating systems are not affected.* This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. CVE-2023-32215:Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. CVE-2023-34414:The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks that exploit human response time delays. If a malicious page elicited user clicks in precise locations immediately before navigating to a site with a certificate error and made the renderer extremely busy at the same time, it could create a gap between when the error page was loaded and when the display actually refreshed. With the right timing the elicited clicks could land in that gap and activate the button that overrides the certificate error for that site. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12. CVE-2023-34416:Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12. CVE-2023-37201:An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. CVE-2023-37202:Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. CVE-2023-37207:A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. CVE-2023-37208:When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. CVE-2023-37211:Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. CVE-2023-4045:Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. CVE-2023-4046:In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. CVE-2023-4047:A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. CVE-2023-4048:An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. CVE-2023-4049:Race conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-after-free vulnerabilities. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. CVE-2023-4050:In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a potentially exploitable crash which could have led to a sandbox escape. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. CVE-2023-4054:When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 116, Firefox ESR < 102.14, Firefox ESR < 115.1, Thunderbird < 102.14, and Thunderbird < 115.1. CVE-2023-4055:When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. CVE-2023-4056:Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. FusionOS firefox-102.14.0-1.u3.fos23.x86_64.rpm firefox-102.14.0-1.u3.fos23.aarch64.rpm FusionOS-SA-2023-2240 Critical FusionOS CVE-2023-39350:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with default compilation flags). When an insufficient blockLen is provided, and proper length validation is not performed, an Integer Underflow occurs, leading to a Denial of Service (DOS) vulnerability. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-39351:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX (rfx) handling. Inside the `rfx_process_message_tileset` function, the program allocates tiles using `rfx_allocate_tiles` for the number of numTiles. If the initialization process of tiles is not completed for various reasons, tiles will have a NULL pointer. Which may be accessed in further processing and would cause a program crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-39352:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-39353:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a missing offset validation leading to Out Of Bound Read. In the `libfreerdp/codec/rfx.c` file there is no offset validation in `tile->quantIdxY`, `tile->quantIdxCb`, and `tile->quantIdxCr`. As a result crafted input can lead to an out of bounds read access which in turn will cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-39354:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out-Of-Bounds Read occurs because it processes `context->Planes` without checking if it contains data of sufficient length. Should an attacker be able to leverage this vulnerability they may be able to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-39356:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a missing offset validation may lead to an Out Of Bound Read in the function `gdi_multi_opaque_rect`. In particular there is no code to validate if the value `multi_opaque_rect->numRectangles` is less than 45. Looping through `multi_opaque_rect->`numRectangles without proper boundary checks can lead to Out-of-Bounds Read errors which will likely lead to a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-40181:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Integer-Underflow leading to Out-Of-Bound Read in the `zgfx_decompress_segment` function. In the context of `CopyMemory`, it's possible to read data beyond the transmitted packet range and likely cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. CVE-2023-40186:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function. This issue affects FreeRDP based clients only. FreeRDP proxies are not affected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. CVE-2023-40188:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `general_LumaToYUV444` function. This Out-Of-Bounds Read occurs because processing is done on the `in` variable without checking if it contains data of sufficient length. Insufficient data for the `in` variable may cause errors or crashes. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. CVE-2023-40567:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `clear_decompress_bands_data` function in which there is no offset validation. Abuse of this vulnerability may lead to an out of bounds write. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability. CVE-2023-40569:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `progressive_decompress` function. This issue is likely down to incorrect calculations of the `nXSrc` and `nYSrc` variables. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability. CVE-2023-40589:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted input into this function can trigger the overflow which has only been shown to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. FusionOS freerdp-2.11.1-1.fos23.x86_64.rpm freerdp-devel-2.11.1-1.fos23.x86_64.rpm libwinpr-2.11.1-1.fos23.x86_64.rpm libwinpr-devel-2.11.1-1.fos23.x86_64.rpm freerdp-help-2.11.1-1.fos23.x86_64.rpm freerdp-2.11.1-1.fos23.aarch64.rpm freerdp-devel-2.11.1-1.fos23.aarch64.rpm libwinpr-2.11.1-1.fos23.aarch64.rpm libwinpr-devel-2.11.1-1.fos23.aarch64.rpm freerdp-help-2.11.1-1.fos23.aarch64.rpm FusionOS-SA-2023-2241 Important FusionOS CVE-2023-36664:Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix). FusionOS ghostscript-9.55.0-5.u3.fos23.x86_64.rpm ghostscript-devel-9.55.0-5.u3.fos23.x86_64.rpm ghostscript-help-9.55.0-5.u3.fos23.noarch.rpm ghostscript-tools-dvipdf-9.55.0-5.u3.fos23.x86_64.rpm ghostscript-9.55.0-5.u3.fos23.aarch64.rpm ghostscript-devel-9.55.0-5.u3.fos23.aarch64.rpm ghostscript-tools-dvipdf-9.55.0-5.u3.fos23.aarch64.rpm FusionOS-SA-2023-2242 Moderate FusionOS CVE-2023-39742:giflib v5.2.1 was discovered to contain a segmentation fault via the component getarg.c. FusionOS giflib-5.2.1-6.u1.fos23.x86_64.rpm giflib-devel-5.2.1-6.u1.fos23.x86_64.rpm giflib-utils-5.2.1-6.u1.fos23.x86_64.rpm giflib-help-5.2.1-6.u1.fos23.noarch.rpm giflib-5.2.1-6.u1.fos23.aarch64.rpm giflib-devel-5.2.1-6.u1.fos23.aarch64.rpm giflib-utils-5.2.1-6.u1.fos23.aarch64.rpm FusionOS-SA-2023-2243 Moderate FusionOS CVE-2023-29409:Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable. FusionOS golang-1.20.5-3.u6.fos23.x86_64.rpm golang-help-1.20.5-3.u6.fos23.noarch.rpm golang-devel-1.20.5-3.u6.fos23.noarch.rpm golang-1.20.5-3.u6.fos23.aarch64.rpm FusionOS-SA-2023-2244 Important FusionOS CVE-2023-37329:Heap overwrite in PGS subtitle overlay decoder. FusionOS gstreamer1-plugins-bad-free-1.16.2-5.u1.fos23.x86_64.rpm gstreamer1-plugins-bad-free-devel-1.16.2-5.u1.fos23.x86_64.rpm gstreamer1-plugins-bad-free-1.16.2-5.u1.fos23.aarch64.rpm gstreamer1-plugins-bad-free-devel-1.16.2-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2245 Important FusionOS CVE-2023-37327:Integer overflow leading to heap overwrite in FLAC image tag handling. CVE-2023-37328:Heap overwrite in subtitle parsing. FusionOS gstreamer1-plugins-base-1.18.4-3.u1.fos23.x86_64.rpm gstreamer1-plugins-base-devel-1.18.4-3.u1.fos23.x86_64.rpm gstreamer1-plugins-base-help-1.18.4-3.u1.fos23.noarch.rpm gstreamer1-plugins-base-1.18.4-3.u1.fos23.aarch64.rpm gstreamer1-plugins-base-devel-1.18.4-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2246 Important FusionOS CVE-2023-37327:Integer overflow leading to heap overwrite in FLAC image tag handling. FusionOS gstreamer1-plugins-good-1.16.2-5.u1.fos23.x86_64.rpm gstreamer1-plugins-good-gtk-1.16.2-5.u1.fos23.x86_64.rpm gstreamer1-plugins-good-help-1.16.2-5.u1.fos23.noarch.rpm gstreamer1-plugins-good-1.16.2-5.u1.fos23.aarch64.rpm gstreamer1-plugins-good-gtk-1.16.2-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2247 Important FusionOS CVE-2022-21549:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.3.1; Oracle GraalVM Enterprise Edition: 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2022-40433:An issue was discovered in function ciMethodBlocks::make_block_at in Oracle JDK (HotSpot VM) 11, 17 and OpenJDK (HotSpot VM) 8, 11, 17, allows attackers to cause a denial of service. CVE-2023-21830:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf; Oracle GraalVM Enterprise Edition: 20.3.8 and 21.3.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2023-21843:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf, 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVE-2023-21930:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). CVE-2023-21937:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2023-21938:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVE-2023-21939:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21954:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21967:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21968:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-22045:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVE-2023-22049:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. FusionOS java-1.8.0-openjdk-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-slowdebug-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-headless-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-headless-slowdebug-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-devel-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-devel-slowdebug-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-demo-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-demo-slowdebug-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-src-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-src-slowdebug-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-javadoc-1.8.0.382.b05-8.u1.fos23.noarch.rpm java-1.8.0-openjdk-javadoc-zip-1.8.0.382.b05-8.u1.fos23.noarch.rpm java-1.8.0-openjdk-accessibility-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-devel-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-slowdebug-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-slowdebug-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-headless-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-headless-slowdebug-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-devel-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-devel-slowdebug-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-demo-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-demo-slowdebug-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-src-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-src-slowdebug-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-accessibility-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-devel-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-slowdebug-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.382.b05-8.u1.fos23.aarch64.rpm FusionOS-SA-2023-2248 Important FusionOS CVE-2022-40433:An issue was discovered in function ciMethodBlocks::make_block_at in Oracle JDK (HotSpot VM) 11, 17 and OpenJDK (HotSpot VM) 8, 11, 17, allows attackers to cause a denial of service. CVE-2023-21835:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via DTLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVE-2023-21843:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf, 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVE-2023-21930:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21937:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21938:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVE-2023-21939:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21954:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21967:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21968:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-22006:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N). CVE-2023-22036:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Utility). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVE-2023-22041:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVE-2023-22045:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVE-2023-22049:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. FusionOS java-11-openjdk-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-slowdebug-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-headless-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-headless-slowdebug-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-devel-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-devel-slowdebug-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-jmods-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-jmods-slowdebug-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-demo-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-demo-slowdebug-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-src-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-src-slowdebug-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-javadoc-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-javadoc-zip-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-slowdebug-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-headless-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-headless-slowdebug-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-devel-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-devel-slowdebug-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-jmods-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-jmods-slowdebug-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-demo-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-demo-slowdebug-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-src-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-src-slowdebug-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-javadoc-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-javadoc-zip-11.0.20.8-2.fos23.aarch64.rpm FusionOS-SA-2023-2249 Important FusionOS CVE-2022-45685:A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data. CVE-2023-1436:An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown. FusionOS jettison-1.3.7-1.u3.fos23.noarch.rpm jettison-javadoc-1.3.7-1.u3.fos23.noarch.rpm FusionOS-SA-2023-2250 Critical FusionOS CVE-2023-1206:A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95%. CVE-2023-20593:An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. CVE-2023-34319:A buffer overrun vulnerability was found in the netback driver in Xen due to an unusual split packet. This flaw allows an unprivileged guest to cause a denial of service (DoS) of the host by sending network packets to the backend, causing the backend to crash. CVE-2023-38432:An issue was discovered in the Linux kernel before 6.3.10. fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload size and the RFC1002 length specification, leading to an out-of-bounds read. CVE-2023-40283:An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled. CVE-2023-4194:A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate. CVE-2023-32250:A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel. CVE-2023-32252:A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_LOGOFF commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. CVE-2023-32257:A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP and SMB2_LOGOFF commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel. CVE-2023-3865:This vulnerability allows remote attackers to disclose sensitive information on affected installations of Linux Kernel. Authentication may or may not be required to exploit this vulnerability, depending upon configuration. Furthermore, only systems with ksmbd enabled are vulnerable. CVE-2023-4273:A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack. CVE-2023-32247:A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. CVE-2023-32249:Linux Kernel ksmbd Multichannel Improper Authentication Session Hijack Vulnerability. CVE-2023-32251:A vulnerability classified as problematic has been found in Linux Kernel up to 6.3 (Operating System). Affected is the function smb2_sess_setup of the file fs/ksmbd/smb2pdu.c of the component ksmbd. The manipulation with an unknown input leads to a improper authentication vulnerability. CVE-2023-32253:Linux Kernel ksmbd Session Deadlock Denial-of-Service Vulnerability CVE-2023-3777:A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner rule can also release the objects in certain circumstances. We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8. CVE-2023-3866:A vulnerability classified as critical was found in Linux Kernel (Operating System) (version now known). This vulnerability affects some unknown processing of the component ksmbd. The manipulation with an unknown input leads to a null pointer dereference vulnerability. CVE-2023-4015:A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used. CVE-2023-4622:A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free. CVE-2023-4623:A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free. CVE-2022-45884:An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops. CVE-2022-45887:An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call. CVE-2023-2156:A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the system. FusionOS kernel-5.10.0-136.49.0.127.u85.fos23.x86_64.rpm kernel-headers-5.10.0-136.49.0.127.u85.fos23.x86_64.rpm kernel-devel-5.10.0-136.49.0.127.u85.fos23.x86_64.rpm kernel-tools-5.10.0-136.49.0.127.u85.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.49.0.127.u85.fos23.x86_64.rpm perf-5.10.0-136.49.0.127.u85.fos23.x86_64.rpm python3-perf-5.10.0-136.49.0.127.u85.fos23.x86_64.rpm bpftool-5.10.0-136.49.0.127.u85.fos23.x86_64.rpm kernel-5.10.0-136.49.0.127.u85.fos23.aarch64.rpm kernel-headers-5.10.0-136.49.0.127.u85.fos23.aarch64.rpm kernel-devel-5.10.0-136.49.0.127.u85.fos23.aarch64.rpm kernel-tools-5.10.0-136.49.0.127.u85.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.49.0.127.u85.fos23.aarch64.rpm perf-5.10.0-136.49.0.127.u85.fos23.aarch64.rpm python3-perf-5.10.0-136.49.0.127.u85.fos23.aarch64.rpm bpftool-5.10.0-136.49.0.127.u85.fos23.aarch64.rpm FusionOS-SA-2023-2251 Important FusionOS CVE-2020-21469:An issue was discovered in PostgreSQL 12.2 allows attackers to cause a denial of service via repeatedly sending SIGHUP signals. NOTE: this is disputed by the vendor because untrusted users cannot send SIGHUP signals; they can only be sent by a PostgreSQL superuser, a user with pg_reload_conf access, or a user with sufficient privileges at the OS level (the postgres account or the root account). CVE-2023-2454:schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code. CVE-2023-2455:Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy. CVE-2023-39417:IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. CVE-2023-39418:A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows. FusionOS libpq-13.12-1.u1.fos23.x86_64.rpm libpq-devel-13.12-1.u1.fos23.x86_64.rpm libpq-13.12-1.u1.fos23.aarch64.rpm libpq-devel-13.12-1.u1.fos23.aarch64.rpm FusionOS-SA-2023-2252 Important FusionOS CVE-2023-38710:An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1, an error notify INVALID_SPI is sent back. The notify payload's protocol ID is copied from the incoming packet, but the code that verifies outgoing packets fails an assertion that the protocol ID must be ESP (2) or AH(3) and causes the pluto daemon to crash and restart. NOTE: the earliest affected version is 3.20. CVE-2023-38711:An issue was discovered in Libreswan before 4.12. When an IKEv1 Quick Mode connection configured with ID_IPV4_ADDR or ID_IPV6_ADDR receives an IDcr payload with ID_FQDN, a NULL pointer dereference causes a crash and restart of the pluto daemon. NOTE: the earliest affected version is 4.6. CVE-2023-38712:An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a NULL pointer dereference on the deleted state causes the pluto daemon to crash and restart. FusionOS libreswan-4.12-1.u1.fos23.x86_64.rpm libreswan-help-4.12-1.u1.fos23.x86_64.rpm libreswan-4.12-1.u1.fos23.aarch64.rpm libreswan-help-4.12-1.u1.fos23.aarch64.rpm FusionOS-SA-2023-2253 Moderate FusionOS CVE-2022-34526:A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file parsed by the "tiffsplit" or "tiffcrop" utilities. FusionOS libtiff-4.3.0-33.u9.fos23.x86_64.rpm libtiff-devel-4.3.0-33.u9.fos23.x86_64.rpm libtiff-static-4.3.0-33.u9.fos23.x86_64.rpm libtiff-tools-4.3.0-33.u9.fos23.x86_64.rpm libtiff-help-4.3.0-33.u9.fos23.noarch.rpm libtiff-4.3.0-33.u9.fos23.aarch64.rpm libtiff-devel-4.3.0-33.u9.fos23.aarch64.rpm libtiff-static-4.3.0-33.u9.fos23.aarch64.rpm libtiff-tools-4.3.0-33.u9.fos23.aarch64.rpm FusionOS-SA-2023-2254 Critical FusionOS CVE-2023-36328:Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS). FusionOS libtommath-1.2.0-4.u2.fos23.x86_64.rpm libtommath-devel-1.2.0-4.u2.fos23.x86_64.rpm libtommath-help-1.2.0-4.u2.fos23.x86_64.rpm libtommath-1.2.0-4.u2.fos23.aarch64.rpm libtommath-devel-1.2.0-4.u2.fos23.aarch64.rpm libtommath-help-1.2.0-4.u2.fos23.aarch64.rpm FusionOS-SA-2023-2255 Moderate FusionOS CVE-2022-33196:Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2022-38090:Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially enable information disclosure via local access. CVE-2022-40982:Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. FusionOS microcode_ctl-2.1-41.fos23.x86_64.rpm FusionOS-SA-2023-2256 Moderate FusionOS CVE-2020-21528:A Segmentation Fault issue discovered in in ieee_segment function in outieee.c in nasm 2.14.03 and 2.15 allows remote attackers to cause a denial of service via crafted assembly file. FusionOS nasm-2.15.05-6.u3.fos23.x86_64.rpm nasm-help-2.15.05-6.u3.fos23.noarch.rpm nasm-2.15.05-6.u3.fos23.aarch64.rpm FusionOS-SA-2023-2257 Important FusionOS CVE-2022-41881:Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder. FusionOS netty-4.1.13-19.u1.fos23.x86_64.rpm netty-help-4.1.13-19.u1.fos23.noarch.rpm netty-4.1.13-19.u1.fos23.aarch64.rpm FusionOS-SA-2023-2258 Critical FusionOS CVE-2022-25881:This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library. CVE-2022-32212:A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks. CVE-2022-32213:The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS). CVE-2022-32214:The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). CVE-2022-32215:The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). CVE-2022-35256:The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling. CVE-2023-23918:A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy. CVE-2023-23920:An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges. CVE-2023-30581:The use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition. CVE-2023-30589:The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20 CVE-2023-30590:A vulnerability has been identified in the Node.js, where a generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet. CVE-2023-32002:The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. CVE-2023-32006:The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. CVE-2023-32559:A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. FusionOS nodejs-12.22.11-5.u2.fos23.x86_64.rpm nodejs-devel-12.22.11-5.u2.fos23.x86_64.rpm nodejs-libs-12.22.11-5.u2.fos23.x86_64.rpm nodejs-full-i18n-12.22.11-5.u2.fos23.x86_64.rpm v8-devel-7.8.279.23-1.12.22.11.5.u2.fos23.x86_64.rpm npm-6.14.16-1.12.22.11.5.u2.fos23.x86_64.rpm nodejs-docs-12.22.11-5.u2.fos23.noarch.rpm nodejs-12.22.11-5.u2.fos23.aarch64.rpm nodejs-devel-12.22.11-5.u2.fos23.aarch64.rpm nodejs-libs-12.22.11-5.u2.fos23.aarch64.rpm nodejs-full-i18n-12.22.11-5.u2.fos23.aarch64.rpm v8-devel-7.8.279.23-1.12.22.11.5.u2.fos23.aarch64.rpm npm-6.14.16-1.12.22.11.5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2259 Important FusionOS CVE-2023-20867:A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. CVE-2023-20900:A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html . FusionOS open-vm-tools-12.0.5-3.u1.fos23.x86_64.rpm open-vm-tools-desktop-12.0.5-3.u1.fos23.x86_64.rpm open-vm-tools-sdmp-12.0.5-3.u1.fos23.x86_64.rpm open-vm-tools-12.0.5-3.u1.fos23.aarch64.rpm open-vm-tools-desktop-12.0.5-3.u1.fos23.aarch64.rpm open-vm-tools-sdmp-12.0.5-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2260 Critical FusionOS CVE-2022-31631:A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote() of PDO_SQLite returning an improperly quoted string. With the implementation of sqlite3_snprintf(), it is possible to force the function to return a single apostrophe if the function is called on user-supplied input without any length restrictions in place. CVE-2023-0567:In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid. CVE-2023-0568:In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification. CVE-2023-0662:In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and excessive number of log entries. This can cause denial of service on the affected server by exhausting CPU resources or disk space. CVE-2023-3823:In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as ImageMagick - may also use this library within the same process, and change that global state for their internal purposes, and leave it in a state where external entities loading is enabled. This can lead to the situation where external XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to PHP. This vulnerable state may persist in the same process across many requests, until the process is shut down. CVE-2023-3824:In PHP version 8.0.* before 8.0.30,  8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE. FusionOS php-8.0.30-1.fos23.x86_64.rpm php-cli-8.0.30-1.fos23.x86_64.rpm php-dbg-8.0.30-1.fos23.x86_64.rpm php-fpm-8.0.30-1.fos23.x86_64.rpm php-common-8.0.30-1.fos23.x86_64.rpm php-devel-8.0.30-1.fos23.x86_64.rpm php-opcache-8.0.30-1.fos23.x86_64.rpm php-ldap-8.0.30-1.fos23.x86_64.rpm php-pdo-8.0.30-1.fos23.x86_64.rpm php-mysqlnd-8.0.30-1.fos23.x86_64.rpm php-pgsql-8.0.30-1.fos23.x86_64.rpm php-process-8.0.30-1.fos23.x86_64.rpm php-odbc-8.0.30-1.fos23.x86_64.rpm php-soap-8.0.30-1.fos23.x86_64.rpm php-snmp-8.0.30-1.fos23.x86_64.rpm php-xml-8.0.30-1.fos23.x86_64.rpm php-mbstring-8.0.30-1.fos23.x86_64.rpm php-gd-8.0.30-1.fos23.x86_64.rpm php-bcmath-8.0.30-1.fos23.x86_64.rpm php-gmp-8.0.30-1.fos23.x86_64.rpm php-dba-8.0.30-1.fos23.x86_64.rpm php-tidy-8.0.30-1.fos23.x86_64.rpm php-embedded-8.0.30-1.fos23.x86_64.rpm php-intl-8.0.30-1.fos23.x86_64.rpm php-enchant-8.0.30-1.fos23.x86_64.rpm php-sodium-8.0.30-1.fos23.x86_64.rpm php-ffi-8.0.30-1.fos23.x86_64.rpm php-help-8.0.30-1.fos23.x86_64.rpm php-8.0.30-1.fos23.aarch64.rpm php-cli-8.0.30-1.fos23.aarch64.rpm php-dbg-8.0.30-1.fos23.aarch64.rpm php-fpm-8.0.30-1.fos23.aarch64.rpm php-common-8.0.30-1.fos23.aarch64.rpm php-devel-8.0.30-1.fos23.aarch64.rpm php-opcache-8.0.30-1.fos23.aarch64.rpm php-ldap-8.0.30-1.fos23.aarch64.rpm php-pdo-8.0.30-1.fos23.aarch64.rpm php-mysqlnd-8.0.30-1.fos23.aarch64.rpm php-pgsql-8.0.30-1.fos23.aarch64.rpm php-process-8.0.30-1.fos23.aarch64.rpm php-odbc-8.0.30-1.fos23.aarch64.rpm php-soap-8.0.30-1.fos23.aarch64.rpm php-snmp-8.0.30-1.fos23.aarch64.rpm php-xml-8.0.30-1.fos23.aarch64.rpm php-mbstring-8.0.30-1.fos23.aarch64.rpm php-gd-8.0.30-1.fos23.aarch64.rpm php-bcmath-8.0.30-1.fos23.aarch64.rpm php-gmp-8.0.30-1.fos23.aarch64.rpm php-dba-8.0.30-1.fos23.aarch64.rpm php-tidy-8.0.30-1.fos23.aarch64.rpm php-embedded-8.0.30-1.fos23.aarch64.rpm php-intl-8.0.30-1.fos23.aarch64.rpm php-enchant-8.0.30-1.fos23.aarch64.rpm php-sodium-8.0.30-1.fos23.aarch64.rpm php-ffi-8.0.30-1.fos23.aarch64.rpm php-help-8.0.30-1.fos23.aarch64.rpm FusionOS-SA-2023-2261 Important FusionOS CVE-2020-23804:Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input. CVE-2022-37050:In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662. CVE-2022-37051:An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file. CVE-2022-37052:A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject. CVE-2022-38349:An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file. FusionOS poppler-0.90.0-6.u3.fos23.x86_64.rpm poppler-devel-0.90.0-6.u3.fos23.x86_64.rpm poppler-glib-0.90.0-6.u3.fos23.x86_64.rpm poppler-glib-devel-0.90.0-6.u3.fos23.x86_64.rpm poppler-glib-doc-0.90.0-6.u3.fos23.noarch.rpm poppler-qt5-0.90.0-6.u3.fos23.x86_64.rpm poppler-qt5-devel-0.90.0-6.u3.fos23.x86_64.rpm poppler-cpp-0.90.0-6.u3.fos23.x86_64.rpm poppler-cpp-devel-0.90.0-6.u3.fos23.x86_64.rpm poppler-utils-0.90.0-6.u3.fos23.x86_64.rpm poppler-help-0.90.0-6.u3.fos23.noarch.rpm poppler-0.90.0-6.u3.fos23.aarch64.rpm poppler-devel-0.90.0-6.u3.fos23.aarch64.rpm poppler-glib-0.90.0-6.u3.fos23.aarch64.rpm poppler-glib-devel-0.90.0-6.u3.fos23.aarch64.rpm poppler-qt5-0.90.0-6.u3.fos23.aarch64.rpm poppler-qt5-devel-0.90.0-6.u3.fos23.aarch64.rpm poppler-cpp-0.90.0-6.u3.fos23.aarch64.rpm poppler-cpp-devel-0.90.0-6.u3.fos23.aarch64.rpm poppler-utils-0.90.0-6.u3.fos23.aarch64.rpm FusionOS-SA-2023-2262 Important FusionOS CVE-2022-2625:A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser. CVE-2023-2454:schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code. CVE-2023-2455:Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy. CVE-2023-39417:IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. FusionOS postgresql-13.3-7.u1.fos23.x86_64.rpm postgresql-server-13.3-7.u1.fos23.x86_64.rpm postgresql-docs-13.3-7.u1.fos23.x86_64.rpm postgresql-contrib-13.3-7.u1.fos23.x86_64.rpm postgresql-server-devel-13.3-7.u1.fos23.x86_64.rpm postgresql-test-rpm-macros-13.3-7.u1.fos23.noarch.rpm postgresql-static-13.3-7.u1.fos23.x86_64.rpm postgresql-plperl-13.3-7.u1.fos23.x86_64.rpm postgresql-plpython3-13.3-7.u1.fos23.x86_64.rpm postgresql-pltcl-13.3-7.u1.fos23.x86_64.rpm postgresql-test-13.3-7.u1.fos23.x86_64.rpm postgresql-llvmjit-13.3-7.u1.fos23.x86_64.rpm postgresql-13.3-7.u1.fos23.aarch64.rpm postgresql-server-13.3-7.u1.fos23.aarch64.rpm postgresql-docs-13.3-7.u1.fos23.aarch64.rpm postgresql-contrib-13.3-7.u1.fos23.aarch64.rpm postgresql-server-devel-13.3-7.u1.fos23.aarch64.rpm postgresql-static-13.3-7.u1.fos23.aarch64.rpm postgresql-plperl-13.3-7.u1.fos23.aarch64.rpm postgresql-plpython3-13.3-7.u1.fos23.aarch64.rpm postgresql-pltcl-13.3-7.u1.fos23.aarch64.rpm postgresql-test-13.3-7.u1.fos23.aarch64.rpm postgresql-llvmjit-13.3-7.u1.fos23.aarch64.rpm FusionOS-SA-2023-2263 Important FusionOS CVE-2015-5237:protobuf allows remote authenticated attackers to cause a heap-based buffer overflow. CVE-2021-22570:Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater. FusionOS protobuf2-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-compiler-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-devel-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-static-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-lite-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-lite-devel-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-lite-static-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-vim-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-emacs-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-emacs-el-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-java-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-javadoc-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-compiler-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-devel-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-static-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-lite-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-lite-devel-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-lite-static-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-vim-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-emacs-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-emacs-el-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-java-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-javadoc-2.5.0-4.u2.fos23.aarch64.rpm FusionOS-SA-2023-2264 Important FusionOS CVE-2022-45198:Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). FusionOS python3-pillow-9.0.1-3.u1.fos23.x86_64.rpm python3-pillow-devel-9.0.1-3.u1.fos23.x86_64.rpm python3-pillow-help-9.0.1-3.u1.fos23.noarch.rpm python3-pillow-tk-9.0.1-3.u1.fos23.x86_64.rpm python3-pillow-qt-9.0.1-3.u1.fos23.x86_64.rpm python3-pillow-9.0.1-3.u1.fos23.aarch64.rpm python3-pillow-devel-9.0.1-3.u1.fos23.aarch64.rpm python3-pillow-tk-9.0.1-3.u1.fos23.aarch64.rpm python3-pillow-qt-9.0.1-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2265 Moderate FusionOS CVE-2023-40217:An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.) FusionOS python3-3.9.9-25.u7.fos23.x86_64.rpm python3-unversioned-command-3.9.9-25.u7.fos23.x86_64.rpm python3-devel-3.9.9-25.u7.fos23.x86_64.rpm python3-debug-3.9.9-25.u7.fos23.x86_64.rpm python3-help-3.9.9-25.u7.fos23.noarch.rpm python3-3.9.9-25.u7.fos23.aarch64.rpm python3-unversioned-command-3.9.9-25.u7.fos23.aarch64.rpm python3-devel-3.9.9-25.u7.fos23.aarch64.rpm python3-debug-3.9.9-25.u7.fos23.aarch64.rpm FusionOS-SA-2023-2266 Critical FusionOS CVE-2022-36648:The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially execute code on the host via execute a malformed program in the guest OS. FusionOS qemu-6.2.0-80.u9.fos23.x86_64.rpm qemu-guest-agent-6.2.0-80.u9.fos23.x86_64.rpm qemu-help-6.2.0-80.u9.fos23.noarch.rpm qemu-img-6.2.0-80.u9.fos23.x86_64.rpm qemu-block-rbd-6.2.0-80.u9.fos23.x86_64.rpm qemu-block-ssh-6.2.0-80.u9.fos23.x86_64.rpm qemu-block-iscsi-6.2.0-80.u9.fos23.x86_64.rpm qemu-block-curl-6.2.0-80.u9.fos23.x86_64.rpm qemu-hw-usb-host-6.2.0-80.u9.fos23.x86_64.rpm qemu-seabios-6.2.0-80.u9.fos23.x86_64.rpm qemu-system-aarch64-6.2.0-80.u9.fos23.x86_64.rpm qemu-system-arm-6.2.0-80.u9.fos23.x86_64.rpm qemu-system-x86_64-6.2.0-80.u9.fos23.x86_64.rpm qemu-system-riscv-6.2.0-80.u9.fos23.x86_64.rpm qemu-6.2.0-80.u9.fos23.aarch64.rpm qemu-guest-agent-6.2.0-80.u9.fos23.aarch64.rpm qemu-img-6.2.0-80.u9.fos23.aarch64.rpm qemu-block-rbd-6.2.0-80.u9.fos23.aarch64.rpm qemu-block-ssh-6.2.0-80.u9.fos23.aarch64.rpm qemu-block-iscsi-6.2.0-80.u9.fos23.aarch64.rpm qemu-block-curl-6.2.0-80.u9.fos23.aarch64.rpm qemu-hw-usb-host-6.2.0-80.u9.fos23.aarch64.rpm qemu-system-aarch64-6.2.0-80.u9.fos23.aarch64.rpm qemu-system-arm-6.2.0-80.u9.fos23.aarch64.rpm qemu-system-x86_64-6.2.0-80.u9.fos23.aarch64.rpm qemu-system-riscv-6.2.0-80.u9.fos23.aarch64.rpm FusionOS-SA-2023-2267 Important FusionOS CVE-2023-32763:An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. When a SVG file with an image inside it is rendered, a QTextLayout buffer overflow can be triggered. CVE-2023-37369:In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length. FusionOS qt-4.8.7-54.u5.fos23.x86_64.rpm qt-devel-4.8.7-54.u5.fos23.x86_64.rpm qt-4.8.7-54.u5.fos23.aarch64.rpm qt-devel-4.8.7-54.u5.fos23.aarch64.rpm FusionOS-SA-2023-2268 Important FusionOS CVE-2023-32762:An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match. CVE-2023-37369:In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length. CVE-2023-33285:An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. QDnsLookup has a buffer over-read via a crafted reply from a DNS server. CVE-2023-34410:An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consider whether the root of a chain is a configured CA certificate. FusionOS qt5-qtbase-5.15.2-9.u4.fos23.x86_64.rpm qt5-qtbase-common-5.15.2-9.u4.fos23.noarch.rpm qt5-qtbase-devel-5.15.2-9.u4.fos23.x86_64.rpm qt5-qtbase-private-devel-5.15.2-9.u4.fos23.x86_64.rpm qt5-qtbase-examples-5.15.2-9.u4.fos23.x86_64.rpm qt5-qtbase-static-5.15.2-9.u4.fos23.x86_64.rpm qt5-qtbase-mysql-5.15.2-9.u4.fos23.x86_64.rpm qt5-qtbase-odbc-5.15.2-9.u4.fos23.x86_64.rpm qt5-qtbase-postgresql-5.15.2-9.u4.fos23.x86_64.rpm qt5-qtbase-gui-5.15.2-9.u4.fos23.x86_64.rpm qt5-qtbase-5.15.2-9.u4.fos23.aarch64.rpm qt5-qtbase-devel-5.15.2-9.u4.fos23.aarch64.rpm qt5-qtbase-private-devel-5.15.2-9.u4.fos23.aarch64.rpm qt5-qtbase-examples-5.15.2-9.u4.fos23.aarch64.rpm qt5-qtbase-static-5.15.2-9.u4.fos23.aarch64.rpm qt5-qtbase-mysql-5.15.2-9.u4.fos23.aarch64.rpm qt5-qtbase-odbc-5.15.2-9.u4.fos23.aarch64.rpm qt5-qtbase-postgresql-5.15.2-9.u4.fos23.aarch64.rpm qt5-qtbase-gui-5.15.2-9.u4.fos23.aarch64.rpm FusionOS-SA-2023-2269 Moderate FusionOS CVE-2022-35977:Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic. The problem is fixed in Redis versions 7.0.8, 6.2.9 and 6.0.17. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2022-3647:** DISPUTED ** A vulnerability, which was classified as problematic, was found in Redis. Affected is the function sigsegvHandler of the file debug.c of the component Crash Report. The manipulation leads to denial of service. The real existence of this vulnerability is still doubted at the moment. The name of the patch is 0bf90d944313919eb8e63d3588bf63a367f020a3. It is recommended to apply a patch to fix this issue. VDB-211962 is the identifier assigned to this vulnerability. NOTE: The vendor claims that this is not a DoS because it applies to the crash logging mechanism which is triggered after a crash has occurred. CVE-2023-22458:Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not including 6.2.9 as well as versions 7.0 up to but not including 7.0.8. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-25155:Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. This problem affects all Redis versions. Patches were released in Redis version(s) 6.0.18, 6.2.11 and 7.0.9. FusionOS redis6-6.2.7-3.u5.fos23.x86_64.rpm redis6-devel-6.2.7-3.u5.fos23.x86_64.rpm redis6-doc-6.2.7-3.u5.fos23.noarch.rpm redis6-6.2.7-3.u5.fos23.aarch64.rpm redis6-devel-6.2.7-3.u5.fos23.aarch64.rpm FusionOS-SA-2023-2270 Low FusionOS CVE-2023-38037:An insecure temporary file vulnerability was found in activesupport rubygem. Contents that will be encrypted are written to a temporary file that has the user’s current umask settings, possibly leading to information disclosure by other users on the same system. FusionOS rubygem-activesupport-6.1.4.1-6.u3.fos23.noarch.rpm rubygem-activesupport-doc-6.1.4.1-6.u3.fos23.noarch.rpm FusionOS-SA-2023-2271 Low FusionOS CVE-2023-38037:An insecure temporary file vulnerability was found in activesupport rubygem. Contents that will be encrypted are written to a temporary file that has the user’s current umask settings, possibly leading to information disclosure by other users on the same system. FusionOS rubygem-railties-6.1.4.1-2.u1.fos23.noarch.rpm rubygem-railties-doc-6.1.4.1-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2272 Moderate FusionOS CVE-2023-41080:URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. The vulnerability is limited to the ROOT (default) web application. FusionOS tomcat-9.0.10-31.u8.fos23.noarch.rpm tomcat-jsvc-9.0.10-31.u8.fos23.noarch.rpm tomcat-help-9.0.10-31.u8.fos23.noarch.rpm FusionOS-SA-2023-2273 Important FusionOS CVE-2023-4733:Use After Free in GitHub repository vim/vim prior to 9.0.1840. CVE-2023-4734:Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846. CVE-2023-4735:Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847. CVE-2023-4736:Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833. CVE-2023-4738:Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848. CVE-2023-4750:Use After Free in GitHub repository vim/vim prior to 9.0.1857. CVE-2023-4752:Use After Free in GitHub repository vim/vim prior to 9.0.1858. CVE-2023-4781:Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873. FusionOS vim-common-9.0-17.u9.fos23.x86_64.rpm vim-minimal-9.0-17.u9.fos23.x86_64.rpm vim-enhanced-9.0-17.u9.fos23.x86_64.rpm vim-filesystem-9.0-17.u9.fos23.noarch.rpm vim-X11-9.0-17.u9.fos23.x86_64.rpm vim-common-9.0-17.u9.fos23.aarch64.rpm vim-minimal-9.0-17.u9.fos23.aarch64.rpm vim-enhanced-9.0-17.u9.fos23.aarch64.rpm vim-X11-9.0-17.u9.fos23.aarch64.rpm FusionOS-SA-2023-2274 Important FusionOS CVE-2023-2906:Due to a failure in validating the length provided by an attacker-crafted CP2179 packet, Wireshark versions 2.0.0 through 4.0.7 is susceptible to a divide by zero allowing for a denial of service attack. CVE-2023-3649:iSCSI dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file CVE-2023-4511:BT SDP dissector infinite loop in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file CVE-2023-4513:BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file FusionOS wireshark-3.6.14-3.u6.fos23.x86_64.rpm wireshark-devel-3.6.14-3.u6.fos23.x86_64.rpm wireshark-help-3.6.14-3.u6.fos23.x86_64.rpm wireshark-3.6.14-3.u6.fos23.aarch64.rpm wireshark-devel-3.6.14-3.u6.fos23.aarch64.rpm wireshark-help-3.6.14-3.u6.fos23.aarch64.rpm FusionOS-SA-2023-2275 Important FusionOS CVE-2022-40152:Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack. FusionOS woodstox-core-5.0.3-1.u1.fos23.noarch.rpm woodstox-core-javadoc-5.0.3-1.u1.fos23.noarch.rpm FusionOS-SA-2023-2276 Moderate FusionOS CVE-2023-5341:A vulnerability was found in ImageMagick <=7.1.1, where heap use-after-free was found in coders/bmp.c.References:https://github.com/ImageMagick/ImageMagick/commit/aa673b2e4defc7cad5bec16c4fc8324f71e531f1 FusionOS ImageMagick-7.1.1.8-5.u6.fos23.x86_64.rpm ImageMagick-devel-7.1.1.8-5.u6.fos23.x86_64.rpm ImageMagick-help-7.1.1.8-5.u6.fos23.x86_64.rpm ImageMagick-perl-7.1.1.8-5.u6.fos23.x86_64.rpm ImageMagick-c++-7.1.1.8-5.u6.fos23.x86_64.rpm ImageMagick-c++-devel-7.1.1.8-5.u6.fos23.x86_64.rpm ImageMagick-7.1.1.8-5.u6.fos23.aarch64.rpm ImageMagick-devel-7.1.1.8-5.u6.fos23.aarch64.rpm ImageMagick-help-7.1.1.8-5.u6.fos23.aarch64.rpm ImageMagick-perl-7.1.1.8-5.u6.fos23.aarch64.rpm ImageMagick-c++-7.1.1.8-5.u6.fos23.aarch64.rpm ImageMagick-c++-devel-7.1.1.8-5.u6.fos23.aarch64.rpm FusionOS-SA-2023-2277 Moderate FusionOS CVE-2023-38469:A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record. CVE-2023-38470:A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function. CVE-2023-38471:A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function. CVE-2023-38472:A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function. CVE-2023-38473:A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function. FusionOS avahi-0.8-17.u3.fos23.x86_64.rpm avahi-tools-0.8-17.u3.fos23.x86_64.rpm avahi-ui-0.8-17.u3.fos23.x86_64.rpm avahi-autoipd-0.8-17.u3.fos23.x86_64.rpm avahi-dnsconfd-0.8-17.u3.fos23.x86_64.rpm avahi-compat-howl-0.8-17.u3.fos23.x86_64.rpm avahi-compat-howl-devel-0.8-17.u3.fos23.x86_64.rpm avahi-compat-libdns_sd-0.8-17.u3.fos23.x86_64.rpm avahi-compat-libdns_sd-devel-0.8-17.u3.fos23.x86_64.rpm avahi-devel-0.8-17.u3.fos23.x86_64.rpm avahi-glib-0.8-17.u3.fos23.x86_64.rpm avahi-glib-devel-0.8-17.u3.fos23.x86_64.rpm avahi-gobject-0.8-17.u3.fos23.x86_64.rpm avahi-gobject-devel-0.8-17.u3.fos23.x86_64.rpm avahi-ui-gtk3-0.8-17.u3.fos23.x86_64.rpm avahi-ui-devel-0.8-17.u3.fos23.x86_64.rpm avahi-libs-0.8-17.u3.fos23.x86_64.rpm avahi-help-0.8-17.u3.fos23.noarch.rpm avahi-0.8-17.u3.fos23.aarch64.rpm avahi-tools-0.8-17.u3.fos23.aarch64.rpm avahi-ui-0.8-17.u3.fos23.aarch64.rpm avahi-autoipd-0.8-17.u3.fos23.aarch64.rpm avahi-dnsconfd-0.8-17.u3.fos23.aarch64.rpm avahi-compat-howl-0.8-17.u3.fos23.aarch64.rpm avahi-compat-howl-devel-0.8-17.u3.fos23.aarch64.rpm avahi-compat-libdns_sd-0.8-17.u3.fos23.aarch64.rpm avahi-compat-libdns_sd-devel-0.8-17.u3.fos23.aarch64.rpm avahi-devel-0.8-17.u3.fos23.aarch64.rpm avahi-glib-0.8-17.u3.fos23.aarch64.rpm avahi-glib-devel-0.8-17.u3.fos23.aarch64.rpm avahi-gobject-0.8-17.u3.fos23.aarch64.rpm avahi-gobject-devel-0.8-17.u3.fos23.aarch64.rpm avahi-ui-gtk3-0.8-17.u3.fos23.aarch64.rpm avahi-ui-devel-0.8-17.u3.fos23.aarch64.rpm avahi-libs-0.8-17.u3.fos23.aarch64.rpm FusionOS-SA-2023-2278 Important FusionOS CVE-2022-38398:Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14. CVE-2022-38648:Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14. CVE-2022-40146:Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14. CVE-2022-44729:Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later. CVE-2022-44730:Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL. FusionOS batik-1.17-1.u2.fos23.noarch.rpm batik-help-1.17-1.u2.fos23.noarch.rpm FusionOS-SA-2023-2279 Important FusionOS CVE-2023-3341:The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly. Since each incoming control channel message is fully parsed before its contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key; only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9 versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through 9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1. FusionOS bind-9.16.23-20.u6.fos23.x86_64.rpm bind-pkcs11-9.16.23-20.u6.fos23.x86_64.rpm bind-pkcs11-utils-9.16.23-20.u6.fos23.x86_64.rpm bind-pkcs11-libs-9.16.23-20.u6.fos23.x86_64.rpm bind-pkcs11-devel-9.16.23-20.u6.fos23.x86_64.rpm bind-libs-9.16.23-20.u6.fos23.x86_64.rpm bind-license-9.16.23-20.u6.fos23.noarch.rpm bind-utils-9.16.23-20.u6.fos23.x86_64.rpm bind-dnssec-utils-9.16.23-20.u6.fos23.x86_64.rpm bind-dnssec-doc-9.16.23-20.u6.fos23.noarch.rpm bind-devel-9.16.23-20.u6.fos23.x86_64.rpm bind-chroot-9.16.23-20.u6.fos23.x86_64.rpm python3-bind-9.16.23-20.u6.fos23.noarch.rpm bind-9.16.23-20.u6.fos23.aarch64.rpm bind-pkcs11-9.16.23-20.u6.fos23.aarch64.rpm bind-pkcs11-utils-9.16.23-20.u6.fos23.aarch64.rpm bind-pkcs11-libs-9.16.23-20.u6.fos23.aarch64.rpm bind-pkcs11-devel-9.16.23-20.u6.fos23.aarch64.rpm bind-libs-9.16.23-20.u6.fos23.aarch64.rpm bind-utils-9.16.23-20.u6.fos23.aarch64.rpm bind-dnssec-utils-9.16.23-20.u6.fos23.aarch64.rpm bind-devel-9.16.23-20.u6.fos23.aarch64.rpm bind-chroot-9.16.23-20.u6.fos23.aarch64.rpm FusionOS-SA-2023-2280 Moderate FusionOS CVE-2022-38533:In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a crafted file. FusionOS binutils-2.37-24.u11.fos23.x86_64.rpm binutils-devel-2.37-24.u11.fos23.x86_64.rpm binutils-help-2.37-24.u11.fos23.x86_64.rpm binutils-2.37-24.u11.fos23.aarch64.rpm binutils-devel-2.37-24.u11.fos23.aarch64.rpm binutils-help-2.37-24.u11.fos23.aarch64.rpm FusionOS-SA-2023-2281 Moderate FusionOS CVE-2022-3854:A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service. CVE-2023-43040:A flaw was found in rgw. This flaw allows an unprivileged user to write to any bucket(s) accessible by a given key if a POST s form-data contains a key called bucket with a value matching the bucket s name used to sign the request. This issue results in a user being able to upload to any bucket accessible by the specified access key as long as the bucket in the POST policy matches the bucket in the said POST form part. FusionOS ceph-16.2.7-19.u8.fos23.x86_64.rpm ceph-base-16.2.7-19.u8.fos23.x86_64.rpm cephadm-16.2.7-19.u8.fos23.noarch.rpm ceph-common-16.2.7-19.u8.fos23.x86_64.rpm ceph-mds-16.2.7-19.u8.fos23.x86_64.rpm ceph-mon-16.2.7-19.u8.fos23.x86_64.rpm ceph-mgr-16.2.7-19.u8.fos23.x86_64.rpm ceph-mgr-dashboard-16.2.7-19.u8.fos23.noarch.rpm ceph-mgr-diskprediction-local-16.2.7-19.u8.fos23.noarch.rpm ceph-mgr-modules-core-16.2.7-19.u8.fos23.noarch.rpm ceph-mgr-rook-16.2.7-19.u8.fos23.noarch.rpm ceph-mgr-k8sevents-16.2.7-19.u8.fos23.noarch.rpm ceph-mgr-cephadm-16.2.7-19.u8.fos23.noarch.rpm ceph-fuse-16.2.7-19.u8.fos23.x86_64.rpm cephfs-mirror-16.2.7-19.u8.fos23.x86_64.rpm rbd-fuse-16.2.7-19.u8.fos23.x86_64.rpm rbd-mirror-16.2.7-19.u8.fos23.x86_64.rpm ceph-immutable-object-cache-16.2.7-19.u8.fos23.x86_64.rpm rbd-nbd-16.2.7-19.u8.fos23.x86_64.rpm ceph-radosgw-16.2.7-19.u8.fos23.x86_64.rpm cephfs-top-16.2.7-19.u8.fos23.noarch.rpm ceph-resource-agents-16.2.7-19.u8.fos23.x86_64.rpm ceph-osd-16.2.7-19.u8.fos23.x86_64.rpm librados2-16.2.7-19.u8.fos23.x86_64.rpm librados-devel-16.2.7-19.u8.fos23.x86_64.rpm libradospp-devel-16.2.7-19.u8.fos23.x86_64.rpm librgw2-16.2.7-19.u8.fos23.x86_64.rpm librgw-devel-16.2.7-19.u8.fos23.x86_64.rpm python3-rgw-16.2.7-19.u8.fos23.x86_64.rpm python3-rados-16.2.7-19.u8.fos23.x86_64.rpm libcephsqlite-16.2.7-19.u8.fos23.x86_64.rpm libcephsqlite-devel-16.2.7-19.u8.fos23.x86_64.rpm libradosstriper1-16.2.7-19.u8.fos23.x86_64.rpm libradosstriper-devel-16.2.7-19.u8.fos23.x86_64.rpm librbd1-16.2.7-19.u8.fos23.x86_64.rpm librbd-devel-16.2.7-19.u8.fos23.x86_64.rpm python3-rbd-16.2.7-19.u8.fos23.x86_64.rpm libcephfs2-16.2.7-19.u8.fos23.x86_64.rpm libcephfs-devel-16.2.7-19.u8.fos23.x86_64.rpm python3-cephfs-16.2.7-19.u8.fos23.x86_64.rpm python3-ceph-argparse-16.2.7-19.u8.fos23.x86_64.rpm python3-ceph-common-16.2.7-19.u8.fos23.x86_64.rpm ceph-test-16.2.7-19.u8.fos23.x86_64.rpm rados-objclass-devel-16.2.7-19.u8.fos23.x86_64.rpm ceph-selinux-16.2.7-19.u8.fos23.x86_64.rpm ceph-grafana-dashboards-16.2.7-19.u8.fos23.noarch.rpm ceph-prometheus-alerts-16.2.7-19.u8.fos23.noarch.rpm ceph-16.2.7-19.u8.fos23.aarch64.rpm ceph-base-16.2.7-19.u8.fos23.aarch64.rpm ceph-common-16.2.7-19.u8.fos23.aarch64.rpm ceph-mds-16.2.7-19.u8.fos23.aarch64.rpm ceph-mon-16.2.7-19.u8.fos23.aarch64.rpm ceph-mgr-16.2.7-19.u8.fos23.aarch64.rpm ceph-fuse-16.2.7-19.u8.fos23.aarch64.rpm cephfs-mirror-16.2.7-19.u8.fos23.aarch64.rpm rbd-fuse-16.2.7-19.u8.fos23.aarch64.rpm rbd-mirror-16.2.7-19.u8.fos23.aarch64.rpm ceph-immutable-object-cache-16.2.7-19.u8.fos23.aarch64.rpm rbd-nbd-16.2.7-19.u8.fos23.aarch64.rpm ceph-radosgw-16.2.7-19.u8.fos23.aarch64.rpm ceph-resource-agents-16.2.7-19.u8.fos23.aarch64.rpm ceph-osd-16.2.7-19.u8.fos23.aarch64.rpm librados2-16.2.7-19.u8.fos23.aarch64.rpm librados-devel-16.2.7-19.u8.fos23.aarch64.rpm libradospp-devel-16.2.7-19.u8.fos23.aarch64.rpm librgw2-16.2.7-19.u8.fos23.aarch64.rpm librgw-devel-16.2.7-19.u8.fos23.aarch64.rpm python3-rgw-16.2.7-19.u8.fos23.aarch64.rpm python3-rados-16.2.7-19.u8.fos23.aarch64.rpm libcephsqlite-16.2.7-19.u8.fos23.aarch64.rpm libcephsqlite-devel-16.2.7-19.u8.fos23.aarch64.rpm libradosstriper1-16.2.7-19.u8.fos23.aarch64.rpm libradosstriper-devel-16.2.7-19.u8.fos23.aarch64.rpm librbd1-16.2.7-19.u8.fos23.aarch64.rpm librbd-devel-16.2.7-19.u8.fos23.aarch64.rpm python3-rbd-16.2.7-19.u8.fos23.aarch64.rpm libcephfs2-16.2.7-19.u8.fos23.aarch64.rpm libcephfs-devel-16.2.7-19.u8.fos23.aarch64.rpm python3-cephfs-16.2.7-19.u8.fos23.aarch64.rpm python3-ceph-argparse-16.2.7-19.u8.fos23.aarch64.rpm python3-ceph-common-16.2.7-19.u8.fos23.aarch64.rpm ceph-test-16.2.7-19.u8.fos23.aarch64.rpm rados-objclass-devel-16.2.7-19.u8.fos23.aarch64.rpm ceph-selinux-16.2.7-19.u8.fos23.aarch64.rpm FusionOS-SA-2023-2282 Important FusionOS CVE-2023-39325:A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function. FusionOS containerd-1.6.22-5.u6.fos23.x86_64.rpm containerd-stress-1.6.22-5.u6.fos23.x86_64.rpm containerd-1.6.22-5.u6.fos23.aarch64.rpm containerd-stress-1.6.22-5.u6.fos23.aarch64.rpm FusionOS-SA-2023-2283 Important FusionOS CVE-2023-4504:Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023. FusionOS cups-2.4.0-10.u4.fos23.x86_64.rpm cups-client-2.4.0-10.u4.fos23.x86_64.rpm cups-devel-2.4.0-10.u4.fos23.x86_64.rpm cups-libs-2.4.0-10.u4.fos23.x86_64.rpm cups-filesystem-2.4.0-10.u4.fos23.noarch.rpm cups-lpd-2.4.0-10.u4.fos23.x86_64.rpm cups-ipptool-2.4.0-10.u4.fos23.x86_64.rpm cups-printerapp-2.4.0-10.u4.fos23.x86_64.rpm cups-help-2.4.0-10.u4.fos23.noarch.rpm cups-2.4.0-10.u4.fos23.aarch64.rpm cups-client-2.4.0-10.u4.fos23.aarch64.rpm cups-devel-2.4.0-10.u4.fos23.aarch64.rpm cups-libs-2.4.0-10.u4.fos23.aarch64.rpm cups-lpd-2.4.0-10.u4.fos23.aarch64.rpm cups-ipptool-2.4.0-10.u4.fos23.aarch64.rpm cups-printerapp-2.4.0-10.u4.fos23.aarch64.rpm FusionOS-SA-2023-2284 Low FusionOS CVE-2023-38545:This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with. CVE-2023-38546:This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. FusionOS curl-7.79.1-24.u11.fos23.x86_64.rpm libcurl-7.79.1-24.u11.fos23.x86_64.rpm libcurl-devel-7.79.1-24.u11.fos23.x86_64.rpm curl-help-7.79.1-24.u11.fos23.noarch.rpm curl-7.79.1-24.u11.fos23.aarch64.rpm libcurl-7.79.1-24.u11.fos23.aarch64.rpm libcurl-devel-7.79.1-24.u11.fos23.aarch64.rpm FusionOS-SA-2023-2285 Critical FusionOS CVE-2022-48337:GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the "etags -u *" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input. FusionOS emacs-27.2-11.u3.fos23.x86_64.rpm emacs-devel-27.2-11.u3.fos23.x86_64.rpm emacs-lucid-27.2-11.u3.fos23.x86_64.rpm emacs-nox-27.2-11.u3.fos23.x86_64.rpm emacs-common-27.2-11.u3.fos23.x86_64.rpm emacs-terminal-27.2-11.u3.fos23.noarch.rpm emacs-filesystem-27.2-11.u3.fos23.noarch.rpm emacs-help-27.2-11.u3.fos23.noarch.rpm emacs-27.2-11.u3.fos23.aarch64.rpm emacs-devel-27.2-11.u3.fos23.aarch64.rpm emacs-lucid-27.2-11.u3.fos23.aarch64.rpm emacs-nox-27.2-11.u3.fos23.aarch64.rpm emacs-common-27.2-11.u3.fos23.aarch64.rpm FusionOS-SA-2023-2286 Important FusionOS CVE-2023-4573:When receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. CVE-2023-4574:When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. CVE-2023-4575:When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. CVE-2023-4576:On Windows, an integer overflow could occur in `RecordedSourceSurfaceCreation` which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape. This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. CVE-2023-4581:Excel `.xll` add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. CVE-2023-4584:Memory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. CVE-2023-4863:Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical) CVE-2023-5217:Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) FusionOS firefox-102.15.0-3.u4.fos23.x86_64.rpm firefox-102.15.0-3.u4.fos23.aarch64.rpm FusionOS-SA-2023-2287 Moderate FusionOS CVE-2023-4039:A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. FusionOS gcc-10.3.1-25.u9.fos23.x86_64.rpm libgcc-10.3.1-25.u9.fos23.x86_64.rpm gcc-c++-10.3.1-25.u9.fos23.x86_64.rpm libstdc++-10.3.1-25.u9.fos23.x86_64.rpm libstdc++-devel-10.3.1-25.u9.fos23.x86_64.rpm libstdc++-static-10.3.1-25.u9.fos23.x86_64.rpm gcc-objc-10.3.1-25.u9.fos23.x86_64.rpm gcc-objc++-10.3.1-25.u9.fos23.x86_64.rpm libobjc-10.3.1-25.u9.fos23.x86_64.rpm gcc-gfortran-10.3.1-25.u9.fos23.x86_64.rpm libgfortran-10.3.1-25.u9.fos23.x86_64.rpm libgfortran-static-10.3.1-25.u9.fos23.x86_64.rpm libgomp-10.3.1-25.u9.fos23.x86_64.rpm gcc-gdb-plugin-10.3.1-25.u9.fos23.x86_64.rpm libgccjit-10.3.1-25.u9.fos23.x86_64.rpm libgccjit-devel-10.3.1-25.u9.fos23.x86_64.rpm libquadmath-10.3.1-25.u9.fos23.x86_64.rpm libquadmath-devel-10.3.1-25.u9.fos23.x86_64.rpm libquadmath-static-10.3.1-25.u9.fos23.x86_64.rpm libitm-10.3.1-25.u9.fos23.x86_64.rpm libitm-devel-10.3.1-25.u9.fos23.x86_64.rpm libitm-static-10.3.1-25.u9.fos23.x86_64.rpm libatomic-10.3.1-25.u9.fos23.x86_64.rpm libatomic-static-10.3.1-25.u9.fos23.x86_64.rpm libasan-10.3.1-25.u9.fos23.x86_64.rpm libasan-static-10.3.1-25.u9.fos23.x86_64.rpm libtsan-10.3.1-25.u9.fos23.x86_64.rpm libtsan-static-10.3.1-25.u9.fos23.x86_64.rpm libubsan-10.3.1-25.u9.fos23.x86_64.rpm libubsan-static-10.3.1-25.u9.fos23.x86_64.rpm liblsan-10.3.1-25.u9.fos23.x86_64.rpm liblsan-static-10.3.1-25.u9.fos23.x86_64.rpm cpp-10.3.1-25.u9.fos23.x86_64.rpm gcc-plugin-devel-10.3.1-25.u9.fos23.x86_64.rpm gcc-10.3.1-25.u9.fos23.aarch64.rpm libgcc-10.3.1-25.u9.fos23.aarch64.rpm gcc-c++-10.3.1-25.u9.fos23.aarch64.rpm libstdc++-10.3.1-25.u9.fos23.aarch64.rpm libstdc++-devel-10.3.1-25.u9.fos23.aarch64.rpm libstdc++-static-10.3.1-25.u9.fos23.aarch64.rpm gcc-objc-10.3.1-25.u9.fos23.aarch64.rpm gcc-objc++-10.3.1-25.u9.fos23.aarch64.rpm libobjc-10.3.1-25.u9.fos23.aarch64.rpm gcc-gfortran-10.3.1-25.u9.fos23.aarch64.rpm libgfortran-10.3.1-25.u9.fos23.aarch64.rpm libgfortran-static-10.3.1-25.u9.fos23.aarch64.rpm libgomp-10.3.1-25.u9.fos23.aarch64.rpm gcc-gdb-plugin-10.3.1-25.u9.fos23.aarch64.rpm libgccjit-10.3.1-25.u9.fos23.aarch64.rpm libgccjit-devel-10.3.1-25.u9.fos23.aarch64.rpm libquadmath-10.3.1-25.u9.fos23.aarch64.rpm libquadmath-devel-10.3.1-25.u9.fos23.aarch64.rpm libquadmath-static-10.3.1-25.u9.fos23.aarch64.rpm libitm-10.3.1-25.u9.fos23.aarch64.rpm libitm-devel-10.3.1-25.u9.fos23.aarch64.rpm libitm-static-10.3.1-25.u9.fos23.aarch64.rpm libatomic-10.3.1-25.u9.fos23.aarch64.rpm libatomic-static-10.3.1-25.u9.fos23.aarch64.rpm libasan-10.3.1-25.u9.fos23.aarch64.rpm libasan-static-10.3.1-25.u9.fos23.aarch64.rpm libtsan-10.3.1-25.u9.fos23.aarch64.rpm libtsan-static-10.3.1-25.u9.fos23.aarch64.rpm libubsan-10.3.1-25.u9.fos23.aarch64.rpm libubsan-static-10.3.1-25.u9.fos23.aarch64.rpm liblsan-10.3.1-25.u9.fos23.aarch64.rpm liblsan-static-10.3.1-25.u9.fos23.aarch64.rpm cpp-10.3.1-25.u9.fos23.aarch64.rpm gcc-plugin-devel-10.3.1-25.u9.fos23.aarch64.rpm FusionOS-SA-2023-2288 Moderate FusionOS CVE-2023-39129:GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap use after free via the function add_pe_exported_sym() at /gdb/coff-pe-read.c. FusionOS gdb-11.1-7.u3.fos23.x86_64.rpm gdb-headless-11.1-7.u3.fos23.x86_64.rpm gdb-gdbserver-11.1-7.u3.fos23.x86_64.rpm gdb-help-11.1-7.u3.fos23.noarch.rpm gdb-11.1-7.u3.fos23.aarch64.rpm gdb-headless-11.1-7.u3.fos23.aarch64.rpm gdb-gdbserver-11.1-7.u3.fos23.aarch64.rpm FusionOS-SA-2023-2289 Moderate FusionOS CVE-2023-39742:giflib v5.2.1 was discovered to contain a segmentation fault via the component getarg.c. FusionOS giflib-5.2.1-7.u2.fos23.x86_64.rpm giflib-devel-5.2.1-7.u2.fos23.x86_64.rpm giflib-utils-5.2.1-7.u2.fos23.x86_64.rpm giflib-help-5.2.1-7.u2.fos23.noarch.rpm giflib-5.2.1-7.u2.fos23.aarch64.rpm giflib-devel-5.2.1-7.u2.fos23.aarch64.rpm giflib-utils-5.2.1-7.u2.fos23.aarch64.rpm FusionOS-SA-2023-2290 Important FusionOS CVE-2023-4806:A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags. CVE-2023-4813:A flaw was found in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge. CVE-2023-4911:A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges. CVE-2023-5156:A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash. FusionOS glibc-2.34-140.u19.fos23.x86_64.rpm glibc-common-2.34-140.u19.fos23.x86_64.rpm glibc-all-langpacks-2.34-140.u19.fos23.x86_64.rpm glibc-locale-source-2.34-140.u19.fos23.x86_64.rpm glibc-locale-archive-2.34-140.u19.fos23.x86_64.rpm glibc-devel-2.34-140.u19.fos23.x86_64.rpm nscd-2.34-140.u19.fos23.x86_64.rpm nss_modules-2.34-140.u19.fos23.x86_64.rpm glibc-nss-devel-2.34-140.u19.fos23.x86_64.rpm libnsl-2.34-140.u19.fos23.x86_64.rpm glibc-debugutils-2.34-140.u19.fos23.x86_64.rpm glibc-help-2.34-140.u19.fos23.noarch.rpm glibc-compat-2.17-2.34-140.u19.fos23.x86_64.rpm glibc-2.34-140.u19.fos23.aarch64.rpm glibc-common-2.34-140.u19.fos23.aarch64.rpm glibc-all-langpacks-2.34-140.u19.fos23.aarch64.rpm glibc-locale-source-2.34-140.u19.fos23.aarch64.rpm glibc-locale-archive-2.34-140.u19.fos23.aarch64.rpm glibc-devel-2.34-140.u19.fos23.aarch64.rpm nscd-2.34-140.u19.fos23.aarch64.rpm nss_modules-2.34-140.u19.fos23.aarch64.rpm glibc-nss-devel-2.34-140.u19.fos23.aarch64.rpm libnsl-2.34-140.u19.fos23.aarch64.rpm glibc-debugutils-2.34-140.u19.fos23.aarch64.rpm glibc-compat-2.17-2.34-140.u19.fos23.aarch64.rpm FusionOS-SA-2023-2291 Important FusionOS CVE-2023-33953:gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow DOS attacks: CVE-2023-4785:Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. FusionOS grpc-1.41.1-8.u3.fos23.x86_64.rpm grpc-devel-1.41.1-8.u3.fos23.x86_64.rpm grpc-plugins-1.41.1-8.u3.fos23.x86_64.rpm python3-grpcio-1.41.1-8.u3.fos23.x86_64.rpm grpc-1.41.1-8.u3.fos23.aarch64.rpm grpc-devel-1.41.1-8.u3.fos23.aarch64.rpm grpc-plugins-1.41.1-8.u3.fos23.aarch64.rpm python3-grpcio-1.41.1-8.u3.fos23.aarch64.rpm FusionOS-SA-2023-2292 Important FusionOS CVE-2023-4692:An out-of-bounds write flaw was found in grub2 s NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub s heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code execution and secure boot protection bypass may be achieved. CVE-2023-4693:An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations. A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, presenting a high Confidentiality risk. FusionOS grub2-common-2.06-38.u12.fos23.noarch.rpm grub2-tools-2.06-38.u12.fos23.x86_64.rpm grub2-tools-minimal-2.06-38.u12.fos23.x86_64.rpm grub2-tools-extra-2.06-38.u12.fos23.x86_64.rpm grub2-tools-efi-2.06-38.u12.fos23.x86_64.rpm grub2-efi-x64-2.06-38.u12.fos23.x86_64.rpm grub2-efi-x64-modules-2.06-38.u12.fos23.noarch.rpm grub2-efi-x64-cdboot-2.06-38.u12.fos23.x86_64.rpm grub2-efi-ia32-2.06-38.u12.fos23.x86_64.rpm grub2-efi-ia32-modules-2.06-38.u12.fos23.noarch.rpm grub2-efi-ia32-cdboot-2.06-38.u12.fos23.x86_64.rpm grub2-pc-2.06-38.u12.fos23.x86_64.rpm grub2-pc-modules-2.06-38.u12.fos23.noarch.rpm grub2-help-2.06-38.u12.fos23.noarch.rpm grub2-tools-2.06-38.u12.fos23.aarch64.rpm grub2-tools-minimal-2.06-38.u12.fos23.aarch64.rpm grub2-tools-extra-2.06-38.u12.fos23.aarch64.rpm FusionOS-SA-2023-2293 Important FusionOS CVE-2023-40474:gstreamer-plugins-bad: GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability CVE-2023-40475:gstreamer-plugins-bad: GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability CVE-2023-40476:gstreamer-plugins-bad: GStreamer H265 Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability FusionOS gstreamer1-plugins-bad-free-1.16.2-6.u2.fos23.x86_64.rpm gstreamer1-plugins-bad-free-devel-1.16.2-6.u2.fos23.x86_64.rpm gstreamer1-plugins-bad-free-1.16.2-6.u2.fos23.aarch64.rpm gstreamer1-plugins-bad-free-devel-1.16.2-6.u2.fos23.aarch64.rpm FusionOS-SA-2023-2294 Important FusionOS CVE-2023-31122:Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57. CVE-2023-45802:When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that.This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. FusionOS httpd-2.4.51-20.u9.fos23.x86_64.rpm httpd-devel-2.4.51-20.u9.fos23.x86_64.rpm httpd-help-2.4.51-20.u9.fos23.noarch.rpm httpd-filesystem-2.4.51-20.u9.fos23.noarch.rpm httpd-tools-2.4.51-20.u9.fos23.x86_64.rpm mod_ssl-2.4.51-20.u9.fos23.x86_64.rpm mod_md-2.4.51-20.u9.fos23.x86_64.rpm mod_proxy_html-2.4.51-20.u9.fos23.x86_64.rpm mod_ldap-2.4.51-20.u9.fos23.x86_64.rpm mod_session-2.4.51-20.u9.fos23.x86_64.rpm httpd-2.4.51-20.u9.fos23.aarch64.rpm httpd-devel-2.4.51-20.u9.fos23.aarch64.rpm httpd-tools-2.4.51-20.u9.fos23.aarch64.rpm mod_ssl-2.4.51-20.u9.fos23.aarch64.rpm mod_md-2.4.51-20.u9.fos23.aarch64.rpm mod_proxy_html-2.4.51-20.u9.fos23.aarch64.rpm mod_ldap-2.4.51-20.u9.fos23.aarch64.rpm mod_session-2.4.51-20.u9.fos23.aarch64.rpm FusionOS-SA-2023-2295 Critical FusionOS CVE-2022-21549:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.3.1; Oracle GraalVM Enterprise Edition: 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2022-40433:An issue was discovered in function ciMethodBlocks::make_block_at in Oracle JDK (HotSpot VM) 11, 17 and OpenJDK (HotSpot VM) 8, 11, 17, allows attackers to cause a denial of service. CVE-2023-21830:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf; Oracle GraalVM Enterprise Edition: 20.3.8 and 21.3.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2023-21835:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via DTLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). CVE-2023-21843:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf, 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2023-2193:Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate an access token. CVE-2023-21930:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). CVE-2023-21938:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2023-21939:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2023-21954:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). CVE-2023-21967:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21968:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2023-22006:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVE-2023-22025:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u381-perf, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 21.3.7 and 22.3.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition,. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2023-22036:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Utility). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). CVE-2023-22041:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVE-2023-22043:Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java SE: 8u371. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVE-2023-22044:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVE-2023-22045:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVE-2023-22049:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVE-2023-22081:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf, 11.0.20, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 20.3.11, 21.3.7 and 22.3.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). FusionOS java-latest-openjdk-21.0.0.35-1.rolling.u1.fos23.x86_64.rpm java-latest-openjdk-headless-21.0.0.35-1.rolling.u1.fos23.x86_64.rpm java-latest-openjdk-devel-21.0.0.35-1.rolling.u1.fos23.x86_64.rpm java-latest-openjdk-jmods-21.0.0.35-1.rolling.u1.fos23.x86_64.rpm java-latest-openjdk-demo-21.0.0.35-1.rolling.u1.fos23.x86_64.rpm java-latest-openjdk-src-21.0.0.35-1.rolling.u1.fos23.x86_64.rpm java-latest-openjdk-javadoc-21.0.0.35-1.rolling.u1.fos23.x86_64.rpm java-latest-openjdk-javadoc-zip-21.0.0.35-1.rolling.u1.fos23.x86_64.rpm java-latest-openjdk-21.0.0.35-1.rolling.u1.fos23.aarch64.rpm java-latest-openjdk-headless-21.0.0.35-1.rolling.u1.fos23.aarch64.rpm java-latest-openjdk-devel-21.0.0.35-1.rolling.u1.fos23.aarch64.rpm java-latest-openjdk-jmods-21.0.0.35-1.rolling.u1.fos23.aarch64.rpm java-latest-openjdk-demo-21.0.0.35-1.rolling.u1.fos23.aarch64.rpm java-latest-openjdk-src-21.0.0.35-1.rolling.u1.fos23.aarch64.rpm java-latest-openjdk-javadoc-21.0.0.35-1.rolling.u1.fos23.aarch64.rpm java-latest-openjdk-javadoc-zip-21.0.0.35-1.rolling.u1.fos23.aarch64.rpm FusionOS-SA-2023-2296 Important FusionOS CVE-2022-40982:Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. CVE-2022-4379:A use-after-free vulnerability was found in __nfs42_ssc_open() in fs/nfs/nfs4file.c in the Linux kernel. This flaw allows an attacker to conduct a remote denial CVE-2022-45887:An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call. CVE-2022-45919:An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event. CVE-2023-20588:A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality. CVE-2023-21400:In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation. CVE-2023-4881:CVE-2023-4881 was wrongly assigned to a bug that was deemed to be a non-security issue by the Linux kernel security team. CVE-2023-4921:A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue(). FusionOS kernel-5.10.0-136.50.0.129.u88.fos23.x86_64.rpm kernel-headers-5.10.0-136.50.0.129.u88.fos23.x86_64.rpm kernel-devel-5.10.0-136.50.0.129.u88.fos23.x86_64.rpm kernel-tools-5.10.0-136.50.0.129.u88.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.50.0.129.u88.fos23.x86_64.rpm perf-5.10.0-136.50.0.129.u88.fos23.x86_64.rpm python3-perf-5.10.0-136.50.0.129.u88.fos23.x86_64.rpm bpftool-5.10.0-136.50.0.129.u88.fos23.x86_64.rpm kernel-5.10.0-136.50.0.129.u88.fos23.aarch64.rpm kernel-headers-5.10.0-136.50.0.129.u88.fos23.aarch64.rpm kernel-devel-5.10.0-136.50.0.129.u88.fos23.aarch64.rpm kernel-tools-5.10.0-136.50.0.129.u88.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.50.0.129.u88.fos23.aarch64.rpm perf-5.10.0-136.50.0.129.u88.fos23.aarch64.rpm python3-perf-5.10.0-136.50.0.129.u88.fos23.aarch64.rpm bpftool-5.10.0-136.50.0.129.u88.fos23.aarch64.rpm FusionOS-SA-2023-2297 Moderate FusionOS CVE-2021-33634:Isula uses the lxc runtime (default) to run malicious images, which can cause DOS. FusionOS lcr-2.0.9-7.u4.fos23.x86_64.rpm lcr-devel-2.0.9-7.u4.fos23.x86_64.rpm lcr-2.0.9-7.u4.fos23.aarch64.rpm lcr-devel-2.0.9-7.u4.fos23.aarch64.rpm FusionOS-SA-2023-2298 Important FusionOS CVE-2023-43785:A vulnerability was found in libX11 due to a boundary condition within the _XkbReadKeySyms() function. This flaw allows a local user to trigger an out-of-bounds read error and read the contents of memory on the system. CVE-2023-43786:A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition. CVE-2023-43787:A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges. FusionOS libX11-1.7.2-8.u2.fos23.x86_64.rpm libX11-devel-1.7.2-8.u2.fos23.x86_64.rpm libX11-help-1.7.2-8.u2.fos23.noarch.rpm libX11-1.7.2-8.u2.fos23.aarch64.rpm libX11-devel-1.7.2-8.u2.fos23.aarch64.rpm FusionOS-SA-2023-2299 Important FusionOS CVE-2023-43786:A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition. CVE-2023-43787:A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges. CVE-2023-43788:A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local to trigger an out-of-bounds read error and read the contents of memory on the system. CVE-2023-43789:A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system. FusionOS libXpm-3.5.13-5.u2.fos23.x86_64.rpm libXpm-devel-3.5.13-5.u2.fos23.x86_64.rpm libXpm-help-3.5.13-5.u2.fos23.noarch.rpm libXpm-3.5.13-5.u2.fos23.aarch64.rpm libXpm-devel-3.5.13-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2300 Important FusionOS CVE-2022-33065:Multiple signed integers overflow in function au_read_header in src/au.c and in functions mat4_open and mat4_read_header in src/mat4.c in Libsndfile, allows an attacker to cause Denial of Service or other unspecified impacts. FusionOS libsndfile-1.0.31-4.u2.fos23.x86_64.rpm libsndfile-devel-1.0.31-4.u2.fos23.x86_64.rpm libsndfile-utils-1.0.31-4.u2.fos23.x86_64.rpm libsndfile-utils-help-1.0.31-4.u2.fos23.noarch.rpm libsndfile-1.0.31-4.u2.fos23.aarch64.rpm libsndfile-devel-1.0.31-4.u2.fos23.aarch64.rpm libsndfile-utils-1.0.31-4.u2.fos23.aarch64.rpm FusionOS-SA-2023-2301 Important FusionOS CVE-2023-44488:VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding. CVE-2023-5217:Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) FusionOS libvpx-1.7.0-10.u2.fos23.x86_64.rpm libvpx-devel-1.7.0-10.u2.fos23.x86_64.rpm libvpx-1.7.0-10.u2.fos23.aarch64.rpm libvpx-devel-1.7.0-10.u2.fos23.aarch64.rpm FusionOS-SA-2023-2302 Important FusionOS CVE-2023-4863:Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical) CVE-2023-5129:This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate of CVE-2023-4863. FusionOS libwebp-1.2.1-3.u2.fos23.x86_64.rpm libwebp-tools-1.2.1-3.u2.fos23.x86_64.rpm libwebp-devel-1.2.1-3.u2.fos23.x86_64.rpm libwebp-java-1.2.1-3.u2.fos23.x86_64.rpm libwebp-help-1.2.1-3.u2.fos23.noarch.rpm libwebp-1.2.1-3.u2.fos23.aarch64.rpm libwebp-tools-1.2.1-3.u2.fos23.aarch64.rpm libwebp-devel-1.2.1-3.u2.fos23.aarch64.rpm libwebp-java-1.2.1-3.u2.fos23.aarch64.rpm FusionOS-SA-2023-2303 Moderate FusionOS CVE-2023-45322:libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail." FusionOS libxml2-2.9.14-9.u4.fos23.x86_64.rpm libxml2-devel-2.9.14-9.u4.fos23.x86_64.rpm python3-libxml2-2.9.14-9.u4.fos23.x86_64.rpm libxml2-help-2.9.14-9.u4.fos23.noarch.rpm libxml2-2.9.14-9.u4.fos23.aarch64.rpm libxml2-devel-2.9.14-9.u4.fos23.aarch64.rpm python3-libxml2-2.9.14-9.u4.fos23.aarch64.rpm FusionOS-SA-2023-2304 Important FusionOS CVE-2023-23583:Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege and/or information disclosure and/or denial of service via local access. FusionOS microcode_ctl-2.1-42.fos23.x86_64.rpm FusionOS-SA-2023-2305 Moderate FusionOS CVE-2023-4874:Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12 CVE-2023-4875:Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12 FusionOS mutt-2.2.12-1.fos23.x86_64.rpm mutt-help-2.2.12-1.fos23.noarch.rpm mutt-2.2.12-1.fos23.aarch64.rpm FusionOS-SA-2023-2306 Important FusionOS CVE-2023-44487:The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. FusionOS nghttp2-1.46.0-5.u3.fos23.x86_64.rpm libnghttp2-1.46.0-5.u3.fos23.x86_64.rpm libnghttp2-devel-1.46.0-5.u3.fos23.x86_64.rpm nghttp2-help-1.46.0-5.u3.fos23.noarch.rpm nghttp2-1.46.0-5.u3.fos23.aarch64.rpm libnghttp2-1.46.0-5.u3.fos23.aarch64.rpm libnghttp2-devel-1.46.0-5.u3.fos23.aarch64.rpm FusionOS-SA-2023-2307 Important FusionOS CVE-2023-44487:The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. FusionOS nginx-1.21.5-6.u2.fos23.x86_64.rpm nginx-all-modules-1.21.5-6.u2.fos23.noarch.rpm nginx-filesystem-1.21.5-6.u2.fos23.noarch.rpm nginx-mod-http-image-filter-1.21.5-6.u2.fos23.x86_64.rpm nginx-mod-http-perl-1.21.5-6.u2.fos23.x86_64.rpm nginx-mod-http-xslt-filter-1.21.5-6.u2.fos23.x86_64.rpm nginx-mod-mail-1.21.5-6.u2.fos23.x86_64.rpm nginx-mod-stream-1.21.5-6.u2.fos23.x86_64.rpm nginx-mod-devel-1.21.5-6.u2.fos23.x86_64.rpm nginx-help-1.21.5-6.u2.fos23.noarch.rpm nginx-1.21.5-6.u2.fos23.aarch64.rpm nginx-mod-http-image-filter-1.21.5-6.u2.fos23.aarch64.rpm nginx-mod-http-perl-1.21.5-6.u2.fos23.aarch64.rpm nginx-mod-http-xslt-filter-1.21.5-6.u2.fos23.aarch64.rpm nginx-mod-mail-1.21.5-6.u2.fos23.aarch64.rpm nginx-mod-stream-1.21.5-6.u2.fos23.aarch64.rpm nginx-mod-devel-1.21.5-6.u2.fos23.aarch64.rpm FusionOS-SA-2023-2308 Important FusionOS CVE-2023-23918:A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy. FusionOS nodejs-12.22.11-6.u3.fos23.x86_64.rpm nodejs-devel-12.22.11-6.u3.fos23.x86_64.rpm nodejs-libs-12.22.11-6.u3.fos23.x86_64.rpm nodejs-full-i18n-12.22.11-6.u3.fos23.x86_64.rpm v8-devel-7.8.279.23-1.12.22.11.6.u3.fos23.x86_64.rpm npm-6.14.16-1.12.22.11.6.u3.fos23.x86_64.rpm nodejs-docs-12.22.11-6.u3.fos23.noarch.rpm nodejs-12.22.11-6.u3.fos23.aarch64.rpm nodejs-devel-12.22.11-6.u3.fos23.aarch64.rpm nodejs-libs-12.22.11-6.u3.fos23.aarch64.rpm nodejs-full-i18n-12.22.11-6.u3.fos23.aarch64.rpm v8-devel-7.8.279.23-1.12.22.11.6.u3.fos23.aarch64.rpm npm-6.14.16-1.12.22.11.6.u3.fos23.aarch64.rpm FusionOS-SA-2023-2309 Important FusionOS CVE-2023-34058:VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html . CVE-2023-34059:open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack the /dev/uinput file descriptor allowing them to simulate user inputs. FusionOS open-vm-tools-12.0.5-4.u2.fos23.x86_64.rpm open-vm-tools-desktop-12.0.5-4.u2.fos23.x86_64.rpm open-vm-tools-sdmp-12.0.5-4.u2.fos23.x86_64.rpm open-vm-tools-12.0.5-4.u2.fos23.aarch64.rpm open-vm-tools-desktop-12.0.5-4.u2.fos23.aarch64.rpm open-vm-tools-sdmp-12.0.5-4.u2.fos23.aarch64.rpm FusionOS-SA-2023-2310 Moderate FusionOS CVE-2023-3446:Checking excessively long DH keys or parameters may be very slow. FusionOS openresty-openssl111-asan-1.1.1h-2.u3.fos23.x86_64.rpm openresty-openssl111-asan-1.1.1h-2.u3.fos23.aarch64.rpm FusionOS-SA-2023-2311 Critical FusionOS CVE-2023-45853:MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. FusionOS openresty-zlib-asan-1.2.11-14.fos23.x86_64.rpm openresty-zlib-asan-1.2.11-14.fos23.aarch64.rpm FusionOS-SA-2023-2312 Important FusionOS CVE-2023-2977:A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible. FusionOS opensc-0.21.0-6.u1.fos23.x86_64.rpm opensc-help-0.21.0-6.u1.fos23.noarch.rpm opensc-0.21.0-6.u1.fos23.aarch64.rpm FusionOS-SA-2023-2313 Moderate FusionOS CVE-2023-5678:Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. FusionOS openssl-1.1.1m-29.u13.fos23.x86_64.rpm openssl-libs-1.1.1m-29.u13.fos23.x86_64.rpm openssl-perl-1.1.1m-29.u13.fos23.x86_64.rpm openssl-devel-1.1.1m-29.u13.fos23.x86_64.rpm openssl-help-1.1.1m-29.u13.fos23.noarch.rpm openssl-1.1.1m-29.u13.fos23.aarch64.rpm openssl-libs-1.1.1m-29.u13.fos23.aarch64.rpm openssl-perl-1.1.1m-29.u13.fos23.aarch64.rpm openssl-devel-1.1.1m-29.u13.fos23.aarch64.rpm FusionOS-SA-2023-2314 Moderate FusionOS CVE-2023-5366:A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed target IP address field that can redirect ICMPv6 traffic to arbitrary IP addresses. FusionOS openvswitch-2.12.4-5.u4.fos23.x86_64.rpm openvswitch-devel-2.12.4-5.u4.fos23.x86_64.rpm openvswitch-help-2.12.4-5.u4.fos23.x86_64.rpm python3-openvswitch-2.12.4-5.u4.fos23.noarch.rpm openvswitch-2.12.4-5.u4.fos23.aarch64.rpm openvswitch-devel-2.12.4-5.u4.fos23.aarch64.rpm openvswitch-help-2.12.4-5.u4.fos23.aarch64.rpm FusionOS-SA-2023-2315 Important FusionOS CVE-2023-41915:OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0. FusionOS pmix-4.2.6-1.fos23.x86_64.rpm pmix-devel-4.2.6-1.fos23.x86_64.rpm pmix-tools-4.2.6-1.fos23.x86_64.rpm pmix-4.2.6-1.fos23.aarch64.rpm pmix-devel-4.2.6-1.fos23.aarch64.rpm pmix-tools-4.2.6-1.fos23.aarch64.rpm FusionOS-SA-2023-2316 Critical FusionOS CVE-2023-41419:An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component. FusionOS python-gevent-help-21.1.2-2.u1.fos23.noarch.rpm python3-gevent-21.1.2-2.u1.fos23.x86_64.rpm python3-gevent-21.1.2-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2317 Important FusionOS CVE-2023-44271:An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument. FusionOS python3-pillow-9.0.1-4.u2.fos23.x86_64.rpm python3-pillow-devel-9.0.1-4.u2.fos23.x86_64.rpm python3-pillow-help-9.0.1-4.u2.fos23.noarch.rpm python3-pillow-tk-9.0.1-4.u2.fos23.x86_64.rpm python3-pillow-qt-9.0.1-4.u2.fos23.x86_64.rpm python3-pillow-9.0.1-4.u2.fos23.aarch64.rpm python3-pillow-devel-9.0.1-4.u2.fos23.aarch64.rpm python3-pillow-tk-9.0.1-4.u2.fos23.aarch64.rpm python3-pillow-qt-9.0.1-4.u2.fos23.aarch64.rpm FusionOS-SA-2023-2318 Important FusionOS CVE-2023-43804:urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5. CVE-2023-45803:urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised. This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren't expecting to respond with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle 301, 302, and 303 redirects manually by stripping the HTTP request body. FusionOS python3-urllib3-1.26.12-6.u5.fos23.noarch.rpm FusionOS-SA-2023-2319 Important FusionOS CVE-2023-24329:An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. CVE-2023-40217:An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.) FusionOS python3-3.9.9-28.u8.fos23.x86_64.rpm python3-unversioned-command-3.9.9-28.u8.fos23.x86_64.rpm python3-devel-3.9.9-28.u8.fos23.x86_64.rpm python3-debug-3.9.9-28.u8.fos23.x86_64.rpm python3-help-3.9.9-28.u8.fos23.noarch.rpm python3-3.9.9-28.u8.fos23.aarch64.rpm python3-unversioned-command-3.9.9-28.u8.fos23.aarch64.rpm python3-devel-3.9.9-28.u8.fos23.aarch64.rpm python3-debug-3.9.9-28.u8.fos23.aarch64.rpm FusionOS-SA-2023-2320 Moderate FusionOS CVE-2023-3255:A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard to the VNC server to trigger a denial of service. CVE-2023-3255:A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard to the VNC server to trigger a denial of service. FusionOS qemu-6.2.0-83.u11.fos23.x86_64.rpm qemu-guest-agent-6.2.0-83.u11.fos23.x86_64.rpm qemu-help-6.2.0-83.u11.fos23.noarch.rpm qemu-img-6.2.0-83.u11.fos23.x86_64.rpm qemu-block-rbd-6.2.0-83.u11.fos23.x86_64.rpm qemu-block-ssh-6.2.0-83.u11.fos23.x86_64.rpm qemu-block-iscsi-6.2.0-83.u11.fos23.x86_64.rpm qemu-block-curl-6.2.0-83.u11.fos23.x86_64.rpm qemu-hw-usb-host-6.2.0-83.u11.fos23.x86_64.rpm qemu-seabios-6.2.0-83.u11.fos23.x86_64.rpm qemu-system-aarch64-6.2.0-83.u11.fos23.x86_64.rpm qemu-system-arm-6.2.0-83.u11.fos23.x86_64.rpm qemu-system-x86_64-6.2.0-83.u11.fos23.x86_64.rpm qemu-system-riscv-6.2.0-83.u11.fos23.x86_64.rpm qemu-6.2.0-83.u11.fos23.aarch64.rpm qemu-guest-agent-6.2.0-83.u11.fos23.aarch64.rpm qemu-img-6.2.0-83.u11.fos23.aarch64.rpm qemu-block-rbd-6.2.0-83.u11.fos23.aarch64.rpm qemu-block-ssh-6.2.0-83.u11.fos23.aarch64.rpm qemu-block-iscsi-6.2.0-83.u11.fos23.aarch64.rpm qemu-block-curl-6.2.0-83.u11.fos23.aarch64.rpm qemu-hw-usb-host-6.2.0-83.u11.fos23.aarch64.rpm qemu-system-aarch64-6.2.0-83.u11.fos23.aarch64.rpm qemu-system-arm-6.2.0-83.u11.fos23.aarch64.rpm qemu-system-x86_64-6.2.0-83.u11.fos23.aarch64.rpm qemu-system-riscv-6.2.0-83.u11.fos23.aarch64.rpm FusionOS-SA-2023-2321 Moderate FusionOS CVE-2023-33285:An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. QDnsLookup has a buffer over-read via a crafted reply from a DNS server. CVE-2023-34410:An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consider whether the root of a chain is a configured CA certificate. FusionOS qt5-qtbase-5.15.2-11.u5.fos23.x86_64.rpm qt5-qtbase-common-5.15.2-11.u5.fos23.noarch.rpm qt5-qtbase-devel-5.15.2-11.u5.fos23.x86_64.rpm qt5-qtbase-private-devel-5.15.2-11.u5.fos23.x86_64.rpm qt5-qtbase-examples-5.15.2-11.u5.fos23.x86_64.rpm qt5-qtbase-static-5.15.2-11.u5.fos23.x86_64.rpm qt5-qtbase-mysql-5.15.2-11.u5.fos23.x86_64.rpm qt5-qtbase-odbc-5.15.2-11.u5.fos23.x86_64.rpm qt5-qtbase-postgresql-5.15.2-11.u5.fos23.x86_64.rpm qt5-qtbase-gui-5.15.2-11.u5.fos23.x86_64.rpm qt5-qtbase-5.15.2-11.u5.fos23.aarch64.rpm qt5-qtbase-devel-5.15.2-11.u5.fos23.aarch64.rpm qt5-qtbase-private-devel-5.15.2-11.u5.fos23.aarch64.rpm qt5-qtbase-examples-5.15.2-11.u5.fos23.aarch64.rpm qt5-qtbase-static-5.15.2-11.u5.fos23.aarch64.rpm qt5-qtbase-mysql-5.15.2-11.u5.fos23.aarch64.rpm qt5-qtbase-odbc-5.15.2-11.u5.fos23.aarch64.rpm qt5-qtbase-postgresql-5.15.2-11.u5.fos23.aarch64.rpm qt5-qtbase-gui-5.15.2-11.u5.fos23.aarch64.rpm FusionOS-SA-2023-2322 Low FusionOS CVE-2023-45145:Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory. FusionOS redis6-6.2.7-3.u6.fos23.x86_64.rpm redis6-devel-6.2.7-3.u6.fos23.x86_64.rpm redis6-doc-6.2.7-3.u6.fos23.noarch.rpm redis6-6.2.7-3.u6.fos23.aarch64.rpm redis6-devel-6.2.7-3.u6.fos23.aarch64.rpm FusionOS-SA-2023-2323 Critical FusionOS CVE-2023-3961:A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand. However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe name containing Unix directory traversal characters (../). This could result in SMB clients connecting as root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe name resolving to an external service using an existing Unix domain socket, it could potentially lead to unauthorized access to the service and consequential adverse events, including compromise or service crashes. CVE-2023-4091:A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions. CVE-2023-4154:A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence. CVE-2023-42669:A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most services and leading to a complete denial of service on the AD DC. The DoS affects all other services as "rpcecho" runs in the main RPC task. CVE-2023-42670:A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high load or unresponsiveness, servers intended for non-AD DC purposes (for example, NT4-emulation "classic DCs") can erroneously start and compete for the same unix domain sockets. This issue leads to partial query responses from the AD DC, causing issues such as "The procedure number is out of range" when using tools like Active Directory Users. This flaw allows an attacker to disrupt AD DC services. FusionOS samba-4.17.5-8.u6.fos23.x86_64.rpm samba-libs-4.17.5-8.u6.fos23.x86_64.rpm samba-client-4.17.5-8.u6.fos23.x86_64.rpm samba-client-libs-4.17.5-8.u6.fos23.x86_64.rpm samba-common-4.17.5-8.u6.fos23.x86_64.rpm samba-common-tools-4.17.5-8.u6.fos23.x86_64.rpm samba-dc-4.17.5-8.u6.fos23.x86_64.rpm samba-dc-provision-4.17.5-8.u6.fos23.x86_64.rpm samba-dc-libs-4.17.5-8.u6.fos23.x86_64.rpm samba-dc-bind-dlz-4.17.5-8.u6.fos23.x86_64.rpm samba-devel-4.17.5-8.u6.fos23.x86_64.rpm samba-vfs-glusterfs-4.17.5-8.u6.fos23.x86_64.rpm samba-krb5-printing-4.17.5-8.u6.fos23.x86_64.rpm libsmbclient-4.17.5-8.u6.fos23.x86_64.rpm libsmbclient-devel-4.17.5-8.u6.fos23.x86_64.rpm libwbclient-4.17.5-8.u6.fos23.x86_64.rpm libwbclient-devel-4.17.5-8.u6.fos23.x86_64.rpm python3-samba-4.17.5-8.u6.fos23.x86_64.rpm python3-samba-test-4.17.5-8.u6.fos23.x86_64.rpm python3-samba-dc-4.17.5-8.u6.fos23.x86_64.rpm samba-pidl-4.17.5-8.u6.fos23.noarch.rpm samba-test-4.17.5-8.u6.fos23.x86_64.rpm samba-usershares-4.17.5-8.u6.fos23.x86_64.rpm samba-winbind-4.17.5-8.u6.fos23.x86_64.rpm samba-winbind-clients-4.17.5-8.u6.fos23.x86_64.rpm samba-winbind-krb5-locator-4.17.5-8.u6.fos23.x86_64.rpm samba-winbind-modules-4.17.5-8.u6.fos23.x86_64.rpm ctdb-4.17.5-8.u6.fos23.x86_64.rpm samba-help-4.17.5-8.u6.fos23.x86_64.rpm samba-4.17.5-8.u6.fos23.aarch64.rpm samba-libs-4.17.5-8.u6.fos23.aarch64.rpm samba-client-4.17.5-8.u6.fos23.aarch64.rpm samba-client-libs-4.17.5-8.u6.fos23.aarch64.rpm samba-common-4.17.5-8.u6.fos23.aarch64.rpm samba-common-tools-4.17.5-8.u6.fos23.aarch64.rpm samba-dc-4.17.5-8.u6.fos23.aarch64.rpm samba-dc-provision-4.17.5-8.u6.fos23.aarch64.rpm samba-dc-libs-4.17.5-8.u6.fos23.aarch64.rpm samba-dc-bind-dlz-4.17.5-8.u6.fos23.aarch64.rpm samba-devel-4.17.5-8.u6.fos23.aarch64.rpm samba-krb5-printing-4.17.5-8.u6.fos23.aarch64.rpm libsmbclient-4.17.5-8.u6.fos23.aarch64.rpm libsmbclient-devel-4.17.5-8.u6.fos23.aarch64.rpm libwbclient-4.17.5-8.u6.fos23.aarch64.rpm libwbclient-devel-4.17.5-8.u6.fos23.aarch64.rpm python3-samba-4.17.5-8.u6.fos23.aarch64.rpm python3-samba-test-4.17.5-8.u6.fos23.aarch64.rpm python3-samba-dc-4.17.5-8.u6.fos23.aarch64.rpm samba-test-4.17.5-8.u6.fos23.aarch64.rpm samba-usershares-4.17.5-8.u6.fos23.aarch64.rpm samba-winbind-4.17.5-8.u6.fos23.aarch64.rpm samba-winbind-clients-4.17.5-8.u6.fos23.aarch64.rpm samba-winbind-krb5-locator-4.17.5-8.u6.fos23.aarch64.rpm samba-winbind-modules-4.17.5-8.u6.fos23.aarch64.rpm ctdb-4.17.5-8.u6.fos23.aarch64.rpm samba-help-4.17.5-8.u6.fos23.aarch64.rpm FusionOS-SA-2023-2324 Important FusionOS CVE-2023-0464:A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. CVE-2023-3817:Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. CVE-2023-40546:A vulnerability classified as critical has been found in rhboot shim up to 15.7 on ARM. This affects the function mirror_one_esl of the file mok.c of the component mok. FusionOS shim-15.6-12.u8.fos23.x86_64.rpm shim-15.6-12.u8.fos23.aarch64.rpm FusionOS-SA-2023-2325 Important FusionOS CVE-2023-43642:snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources. FusionOS snappy-java-1.1.2.4-3.u2.fos23.x86_64.rpm snappy-java-javadoc-1.1.2.4-3.u2.fos23.noarch.rpm snappy-java-1.1.2.4-3.u2.fos23.aarch64.rpm FusionOS-SA-2023-2326 Critical FusionOS CVE-2023-32697:SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2. FusionOS sqlite-jdbc-3.15.1-2.u1.fos23.x86_64.rpm sqlite-jdbc-javadoc-3.15.1-2.u1.fos23.noarch.rpm sqlite-jdbc-3.15.1-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2327 Important FusionOS CVE-2023-46724:Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages. CVE-2023-46728:Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this bug are possible to be received from any gopher server, even those without malicious intent. Gopher support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should reject all gopher URL requests. CVE-2023-46846:SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems. CVE-2023-46847:Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication. FusionOS squid-4.9-20.u1.fos23.x86_64.rpm squid-4.9-20.u1.fos23.aarch64.rpm FusionOS-SA-2023-2328 Moderate FusionOS CVE-2023-45648:Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. FusionOS tomcat-9.0.10-32.u9.fos23.noarch.rpm tomcat-jsvc-9.0.10-32.u9.fos23.noarch.rpm tomcat-help-9.0.10-32.u9.fos23.noarch.rpm FusionOS-SA-2023-2329 Moderate FusionOS CVE-2023-46316:In buc Traceroute 2.0.12 through 2.1.2 before 2.1.3, the wrapper scripts do not properly parse command lines. FusionOS traceroute-2.1.2-2.fos23.x86_64.rpm traceroute-help-2.1.2-2.fos23.noarch.rpm traceroute-2.1.2-2.fos23.aarch64.rpm FusionOS-SA-2023-2330 Important FusionOS CVE-2023-46246:Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the file `src/alloc.c` at line 748, which is freed in the file `src/ex_docmd.c` in the function `do_cmdline` at line 1010 and then used again in `src/cmdhist.c` at line 759. When using the `:history` command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068. CVE-2023-5344:Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1969. CVE-2023-5441:NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960. CVE-2023-5535:Use After Free in GitHub repository vim/vim prior to v9.0.2010. FusionOS vim-common-9.0-21.u11.fos23.x86_64.rpm vim-minimal-9.0-21.u11.fos23.x86_64.rpm vim-enhanced-9.0-21.u11.fos23.x86_64.rpm vim-filesystem-9.0-21.u11.fos23.noarch.rpm vim-X11-9.0-21.u11.fos23.x86_64.rpm vim-common-9.0-21.u11.fos23.aarch64.rpm vim-minimal-9.0-21.u11.fos23.aarch64.rpm vim-enhanced-9.0-21.u11.fos23.aarch64.rpm vim-X11-9.0-21.u11.fos23.aarch64.rpm FusionOS-SA-2023-2331 Moderate FusionOS CVE-2023-5371:RTPS dissector memory leak in Wireshark 4.0.0 to 4.0.8 and 3.6.0 to 3.6.16 allows denial of service via packet injection or crafted capture file FusionOS wireshark-3.6.14-4.u7.fos23.x86_64.rpm wireshark-devel-3.6.14-4.u7.fos23.x86_64.rpm wireshark-help-3.6.14-4.u7.fos23.x86_64.rpm wireshark-3.6.14-4.u7.fos23.aarch64.rpm wireshark-devel-3.6.14-4.u7.fos23.aarch64.rpm wireshark-help-3.6.14-4.u7.fos23.aarch64.rpm FusionOS-SA-2023-2332 Important FusionOS CVE-2023-5367:A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible escalation of privileges or denial of service. CVE-2023-5380:A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if the pointer is warped from within a window on one screen to the root window of the other screen and if the original window is destroyed followed by another window being destroyed. CVE-2023-5574:A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service. CVE-2023-5574:A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service. FusionOS xorg-x11-server-1.20.11-23.u10.fos23.x86_64.rpm xorg-x11-server-common-1.20.11-23.u10.fos23.x86_64.rpm xorg-x11-server-Xnest-1.20.11-23.u10.fos23.x86_64.rpm xorg-x11-server-Xdmx-1.20.11-23.u10.fos23.x86_64.rpm xorg-x11-server-Xvfb-1.20.11-23.u10.fos23.x86_64.rpm xorg-x11-server-Xephyr-1.20.11-23.u10.fos23.x86_64.rpm xorg-x11-server-devel-1.20.11-23.u10.fos23.x86_64.rpm xorg-x11-server-help-1.20.11-23.u10.fos23.noarch.rpm xorg-x11-server-source-1.20.11-23.u10.fos23.noarch.rpm xorg-x11-server-1.20.11-23.u10.fos23.aarch64.rpm xorg-x11-server-common-1.20.11-23.u10.fos23.aarch64.rpm xorg-x11-server-Xnest-1.20.11-23.u10.fos23.aarch64.rpm xorg-x11-server-Xdmx-1.20.11-23.u10.fos23.aarch64.rpm xorg-x11-server-Xvfb-1.20.11-23.u10.fos23.aarch64.rpm xorg-x11-server-Xephyr-1.20.11-23.u10.fos23.aarch64.rpm xorg-x11-server-devel-1.20.11-23.u10.fos23.aarch64.rpm FusionOS-SA-2023-2333 Critical FusionOS CVE-2023-45853:MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. FusionOS zlib-1.2.11-24.u1.fos23.x86_64.rpm zlib-devel-1.2.11-24.u1.fos23.x86_64.rpm zlib-help-1.2.11-24.u1.fos23.noarch.rpm minizip-1.2.11-24.u1.fos23.x86_64.rpm minizip-devel-1.2.11-24.u1.fos23.x86_64.rpm zlib-1.2.11-24.u1.fos23.aarch64.rpm zlib-devel-1.2.11-24.u1.fos23.aarch64.rpm minizip-1.2.11-24.u1.fos23.aarch64.rpm minizip-devel-1.2.11-24.u1.fos23.aarch64.rpm FusionOS-SA-2023-2334 Critical FusionOS CVE-2023-44981:Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like 'eve@EXAMPLE.COM', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default. FusionOS zookeeper-3.6.2-2.4.u1.fos23.noarch.rpm FusionOS-SA-2023-2335 Moderate FusionOS CVE-2021-37533:Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. FusionOS apache-commons-net-3.6-7.u3.fos23.noarch.rpm apache-commons-net-help-3.6-7.u3.fos23.noarch.rpm FusionOS-SA-2023-2336 Moderate FusionOS CVE-2023-46218:This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain. CVE-2023-46219:When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use. FusionOS curl-7.79.1-25.u12.fos23.x86_64.rpm libcurl-7.79.1-25.u12.fos23.x86_64.rpm libcurl-devel-7.79.1-25.u12.fos23.x86_64.rpm curl-help-7.79.1-25.u12.fos23.noarch.rpm curl-7.79.1-25.u12.fos23.aarch64.rpm libcurl-7.79.1-25.u12.fos23.aarch64.rpm libcurl-devel-7.79.1-25.u12.fos23.aarch64.rpm FusionOS-SA-2023-2337 Moderate FusionOS CVE-2023-39130:GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap buffer overflow via the function pe_as16() at /gdb/coff-pe-read.c. FusionOS gdb-11.1-8.u4.fos23.x86_64.rpm gdb-headless-11.1-8.u4.fos23.x86_64.rpm gdb-gdbserver-11.1-8.u4.fos23.x86_64.rpm gdb-help-11.1-8.u4.fos23.noarch.rpm gdb-11.1-8.u4.fos23.aarch64.rpm gdb-headless-11.1-8.u4.fos23.aarch64.rpm gdb-gdbserver-11.1-8.u4.fos23.aarch64.rpm FusionOS-SA-2023-2338 Important FusionOS CVE-2023-46751:An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the application via a dangling pointer. FusionOS ghostscript-9.55.0-5.u4.fos23.x86_64.rpm ghostscript-devel-9.55.0-5.u4.fos23.x86_64.rpm ghostscript-help-9.55.0-5.u4.fos23.noarch.rpm ghostscript-tools-dvipdf-9.55.0-5.u4.fos23.x86_64.rpm ghostscript-9.55.0-5.u4.fos23.aarch64.rpm ghostscript-devel-9.55.0-5.u4.fos23.aarch64.rpm ghostscript-tools-dvipdf-9.55.0-5.u4.fos23.aarch64.rpm FusionOS-SA-2023-2339 Important FusionOS CVE-2023-48161:Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c FusionOS giflib-5.2.1-7.u3.fos23.x86_64.rpm giflib-devel-5.2.1-7.u3.fos23.x86_64.rpm giflib-utils-5.2.1-7.u3.fos23.x86_64.rpm giflib-help-5.2.1-7.u3.fos23.noarch.rpm giflib-5.2.1-7.u3.fos23.aarch64.rpm giflib-devel-5.2.1-7.u3.fos23.aarch64.rpm giflib-utils-5.2.1-7.u3.fos23.aarch64.rpm FusionOS-SA-2023-2340 Moderate FusionOS CVE-2023-5981:A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. FusionOS gnutls-3.7.2-10.u4.fos23.x86_64.rpm gnutls-devel-3.7.2-10.u4.fos23.x86_64.rpm gnutls-utils-3.7.2-10.u4.fos23.x86_64.rpm gnutls-help-3.7.2-10.u4.fos23.noarch.rpm gnutls-3.7.2-10.u4.fos23.aarch64.rpm gnutls-devel-3.7.2-10.u4.fos23.aarch64.rpm gnutls-utils-3.7.2-10.u4.fos23.aarch64.rpm FusionOS-SA-2023-2341 Important FusionOS CVE-2023-0836:An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way. CVE-2023-45539:HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server. FusionOS haproxy-2.6.6-8.u6.fos23.x86_64.rpm haproxy-help-2.6.6-8.u6.fos23.noarch.rpm haproxy-2.6.6-8.u6.fos23.aarch64.rpm FusionOS-SA-2023-2342 Critical FusionOS CVE-2022-41853:Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled. FusionOS hsqldb-2.4.0-5.u1.fos23.noarch.rpm hsqldb-lib-2.4.0-5.u1.fos23.noarch.rpm hsqldb-manual-2.4.0-5.u1.fos23.noarch.rpm hsqldb-javadoc-2.4.0-5.u1.fos23.noarch.rpm hsqldb-demo-2.4.0-5.u1.fos23.noarch.rpm FusionOS-SA-2023-2343 Moderate FusionOS CVE-2023-22067:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf; Oracle GraalVM Enterprise Edition: 20.3.11 and 21.3.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via CORBA to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2023-22081:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf, 11.0.20, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 20.3.11, 21.3.7 and 22.3.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). FusionOS java-1.8.0-openjdk-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-slowdebug-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-headless-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-headless-slowdebug-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-devel-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-devel-slowdebug-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-demo-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-demo-slowdebug-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-src-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-src-slowdebug-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-javadoc-1.8.0.392.b08-2.u1.fos23.noarch.rpm java-1.8.0-openjdk-javadoc-zip-1.8.0.392.b08-2.u1.fos23.noarch.rpm java-1.8.0-openjdk-accessibility-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-devel-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-slowdebug-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-slowdebug-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-headless-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-headless-slowdebug-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-devel-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-devel-slowdebug-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-demo-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-demo-slowdebug-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-src-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-src-slowdebug-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-accessibility-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-devel-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-slowdebug-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.392.b08-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2344 Moderate FusionOS CVE-2023-22081:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf, 11.0.20, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 20.3.11, 21.3.7 and 22.3.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). CVE-2023-22025:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u381-perf, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 21.3.7 and 22.3.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition,. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). FusionOS java-11-openjdk-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-slowdebug-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-headless-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-headless-slowdebug-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-devel-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-devel-slowdebug-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-jmods-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-jmods-slowdebug-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-demo-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-demo-slowdebug-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-src-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-src-slowdebug-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-javadoc-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-javadoc-zip-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-slowdebug-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-headless-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-headless-slowdebug-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-devel-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-devel-slowdebug-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-jmods-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-jmods-slowdebug-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-demo-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-demo-slowdebug-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-src-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-src-slowdebug-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-javadoc-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-javadoc-zip-11.0.21.9-1.fos23.aarch64.rpm FusionOS-SA-2023-2345 Important FusionOS CVE-2022-40149:Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack. CVE-2022-40150:Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack. CVE-2022-45685:A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data. CVE-2022-45693:Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string. CVE-2023-1436:An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown. FusionOS jettison-1.5.4-1.u3.fos23.noarch.rpm jettison-javadoc-1.5.4-1.u3.fos23.noarch.rpm FusionOS-SA-2023-2346 Critical FusionOS CVE-2023-42755:A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to crash the system and cause a denial of service. CVE-2023-5197:A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free. CVE-2023-1193:A use-after-free flaw was found in setup_async_work in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. This issue could allow an attacker to crash the system by accessing freed work. CVE-2023-25775:Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30 may allow an unauthenticated user to potentially enable escalation of privilege via network access. CVE-2023-47233:The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in the device unplugging (disconnect the USB by hotplug) code. For physically proximate attackers with local access, this "could be exploited in a real world scenario." This is related to brcmf_cfg80211_escan_timeout_worker in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c. CVE-2023-6176:A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific socket configuration, which could allow a local user to crash the system or escalate their privileges on the system. CVE-2023-39197:An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol. CVE-2023-5197:A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free. CVE-2023-42753:An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system. CVE-2023-39194:A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information disclosure. CVE-2023-45871:An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. CVE-2023-42754:A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash the system. CVE-2023-39192:A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyond the array boundaries, leading to a crash or information disclosure. CVE-2023-39193:A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. CVE-2023-39189:A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. CVE-2023-31085:An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0. CVE-2023-5717:A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer. CVE-2023-45862:An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. An object could potentially extend beyond the end of an allocation. CVE-2022-45919:An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event. CVE-2023-31083:An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before hu->proto is set. A NULL pointer dereference may occur. CVE-2023-2593:VUL-0: CVE-2023-2593: kernel: Linux Kernel ksmbd Memory Exhaustion Denial-of-Service Vulnerability CVE-2023-32256:This vulnerability allows remote attackers to disclose sensitive information on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability, but only systems with ksmbd enabled are vulnerable.The specific flaw exists within the processing of SMB2_QUERY_INFO and SMB2_LOGOFF commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. CVE-2023-32258:A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_LOGOFF and SMB2_CLOSE commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel. CVE-2023-32246:VUL-0: CVE-2023-32246: kernel: Linux Kernel ksmbd RCU Callback Race Condition Local Privilege Escalation Vulnerability CVE-2023-32254:A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel. CVE-2022-44033:An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cm4040_open() and reader_detach(). CVE-2023-34324:Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual device on the other side. As this action will cause console messages to be issued on the other side quite often, the chance of triggering the deadlock is not neglectable.A (malicious) guest administrator could cause a denial of service (DoS) in a backend domain (other than dom0) by disabling a paravirtualized device. A malicious backend could cause DoS in a guest running a Linux kernel by disabling a paravirtualized device. CVE-2023-2898:There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a denial of service problem. CVE-2023-46862:An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur. CVE-2023-37453:An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in read_descriptors in drivers/usb/core/sysfs.c. CVE-2023-5178:A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious local privileged user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation problem. CVE-2023-46813:An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it. CVE-2022-45884:An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops. CVE-2023-39198:A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation. FusionOS kernel-5.10.0-136.57.0.136.u94.fos23.x86_64.rpm kernel-headers-5.10.0-136.57.0.136.u94.fos23.x86_64.rpm kernel-devel-5.10.0-136.57.0.136.u94.fos23.x86_64.rpm kernel-tools-5.10.0-136.57.0.136.u94.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.57.0.136.u94.fos23.x86_64.rpm perf-5.10.0-136.57.0.136.u94.fos23.x86_64.rpm python3-perf-5.10.0-136.57.0.136.u94.fos23.x86_64.rpm bpftool-5.10.0-136.57.0.136.u94.fos23.x86_64.rpm kernel-5.10.0-136.57.0.136.u94.fos23.aarch64.rpm kernel-headers-5.10.0-136.57.0.136.u94.fos23.aarch64.rpm kernel-devel-5.10.0-136.57.0.136.u94.fos23.aarch64.rpm kernel-tools-5.10.0-136.57.0.136.u94.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.57.0.136.u94.fos23.aarch64.rpm perf-5.10.0-136.57.0.136.u94.fos23.aarch64.rpm python3-perf-5.10.0-136.57.0.136.u94.fos23.aarch64.rpm bpftool-5.10.0-136.57.0.136.u94.fos23.aarch64.rpm FusionOS-SA-2023-2347 Moderate FusionOS CVE-2023-6277:An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft input with size smaller than 379 KB. CVE-2023-6277:An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft input with size smaller than 379 KB. CVE-2023-6228:An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash. FusionOS libtiff-4.3.0-36.u12.fos23.x86_64.rpm libtiff-devel-4.3.0-36.u12.fos23.x86_64.rpm libtiff-static-4.3.0-36.u12.fos23.x86_64.rpm libtiff-tools-4.3.0-36.u12.fos23.x86_64.rpm libtiff-help-4.3.0-36.u12.fos23.noarch.rpm libtiff-4.3.0-36.u12.fos23.aarch64.rpm libtiff-devel-4.3.0-36.u12.fos23.aarch64.rpm libtiff-static-4.3.0-36.u12.fos23.aarch64.rpm libtiff-tools-4.3.0-36.u12.fos23.aarch64.rpm FusionOS-SA-2023-2348 Important FusionOS CVE-2022-1941:A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated. FusionOS sgxsdk-2.15.1-9.u1.fos23.x86_64.rpm libsgx-ae-qe3-2.15.1-9.u1.fos23.x86_64.rpm libsgx-pce-logic-2.15.1-9.u1.fos23.x86_64.rpm libsgx-qe3-logic-2.15.1-9.u1.fos23.x86_64.rpm sgx-aesm-service-2.15.1-9.u1.fos23.x86_64.rpm libsgx-ae-epid-2.15.1-9.u1.fos23.x86_64.rpm libsgx-ae-le-2.15.1-9.u1.fos23.x86_64.rpm libsgx-ae-pce-2.15.1-9.u1.fos23.x86_64.rpm libsgx-aesm-ecdsa-plugin-2.15.1-9.u1.fos23.x86_64.rpm libsgx-aesm-epid-plugin-2.15.1-9.u1.fos23.x86_64.rpm libsgx-aesm-launch-plugin-2.15.1-9.u1.fos23.x86_64.rpm libsgx-aesm-pce-plugin-2.15.1-9.u1.fos23.x86_64.rpm libsgx-aesm-quote-ex-plugin-2.15.1-9.u1.fos23.x86_64.rpm libsgx-epid-2.15.1-9.u1.fos23.x86_64.rpm libsgx-epid-devel-2.15.1-9.u1.fos23.x86_64.rpm libsgx-launch-2.15.1-9.u1.fos23.x86_64.rpm libsgx-launch-devel-2.15.1-9.u1.fos23.x86_64.rpm libsgx-quote-ex-2.15.1-9.u1.fos23.x86_64.rpm libsgx-quote-ex-devel-2.15.1-9.u1.fos23.x86_64.rpm libsgx-uae-service-2.15.1-9.u1.fos23.x86_64.rpm libsgx-enclave-common-2.15.1-9.u1.fos23.x86_64.rpm libsgx-enclave-common-devel-2.15.1-9.u1.fos23.x86_64.rpm libsgx-urts-2.15.1-9.u1.fos23.x86_64.rpm libsgx-dcap-default-qpl-2.15.1-9.u1.fos23.x86_64.rpm libsgx-dcap-default-qpl-devel-2.15.1-9.u1.fos23.x86_64.rpm sgx-dcap-pccs-2.15.1-9.u1.fos23.x86_64.rpm libsgx-dcap-ql-2.15.1-9.u1.fos23.x86_64.rpm libsgx-dcap-ql-devel-2.15.1-9.u1.fos23.x86_64.rpm libsgx-ae-qve-2.15.1-9.u1.fos23.x86_64.rpm libsgx-dcap-quote-verify-2.15.1-9.u1.fos23.x86_64.rpm libsgx-dcap-quote-verify-devel-2.15.1-9.u1.fos23.x86_64.rpm sgx-pck-id-retrieval-tool-2.15.1-9.u1.fos23.x86_64.rpm libsgx-ra-uefi-2.15.1-9.u1.fos23.x86_64.rpm libsgx-ra-uefi-devel-2.15.1-9.u1.fos23.x86_64.rpm libsgx-ra-network-2.15.1-9.u1.fos23.x86_64.rpm libsgx-ra-network-devel-2.15.1-9.u1.fos23.x86_64.rpm sgx-ra-service-2.15.1-9.u1.fos23.x86_64.rpm libsgx-headers-2.15.1-9.u1.fos23.x86_64.rpm FusionOS-SA-2023-2349 Important FusionOS CVE-2023-5157:A vulnerability was found in MariaDB. An OpenVAS port scan on ports 3306 and 4567 allows a malicious remote client to cause a denial of service. CVE-2022-47015:MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer. CVE-2022-38791:In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users to trigger a deadlock. CVE-2022-0778:The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc). CVE-2022-32087:MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args. CVE-2022-32091:MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc. CVE-2022-32085:MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor. CVE-2022-32084:MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select. CVE-2022-32088:MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort. CVE-2022-32083:MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker. CVE-2020-28912:With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible for an unprivileged user with an ability to run code on the server machine to intercept the named pipe connection and act as a man-in-the-middle, gaining access to all the data passed between the client and the server, and getting the ability to run SQL commands on behalf of the connected user. This occurs because of an incorrect security descriptor. This affects MariaDB Server before 10.1.48, 10.2.x before 10.2.35, 10.3.x before 10.3.26, 10.4.x before 10.4.16, and 10.5.x before 10.5.7. NOTE: this issue exists because certain details of the MariaDB CVE-2019-2503 fix did not comprehensively address attack variants against MariaDB. This situation is specific to MariaDB, and thus CVE-2020-28912 does NOT apply to other vendors that were originally affected by CVE-2019-2503. CVE-2021-2144:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). FusionOS mariadb-10.5.22-1.fos23.x86_64.rpm mariadb-config-10.5.22-1.fos23.x86_64.rpm mariadb-common-10.5.22-1.fos23.x86_64.rpm mariadb-errmsg-10.5.22-1.fos23.x86_64.rpm mariadb-server-galera-10.5.22-1.fos23.x86_64.rpm mariadb-server-10.5.22-1.fos23.x86_64.rpm mariadb-oqgraph-engine-10.5.22-1.fos23.x86_64.rpm mariadb-backup-10.5.22-1.fos23.x86_64.rpm mariadb-gssapi-server-10.5.22-1.fos23.x86_64.rpm mariadb-pam-10.5.22-1.fos23.x86_64.rpm mariadb-server-utils-10.5.22-1.fos23.x86_64.rpm mariadb-devel-10.5.22-1.fos23.x86_64.rpm mariadb-embedded-10.5.22-1.fos23.x86_64.rpm mariadb-embedded-devel-10.5.22-1.fos23.x86_64.rpm mariadb-test-10.5.22-1.fos23.x86_64.rpm mariadb-10.5.22-1.fos23.aarch64.rpm mariadb-config-10.5.22-1.fos23.aarch64.rpm mariadb-common-10.5.22-1.fos23.aarch64.rpm mariadb-errmsg-10.5.22-1.fos23.aarch64.rpm mariadb-server-galera-10.5.22-1.fos23.aarch64.rpm mariadb-server-10.5.22-1.fos23.aarch64.rpm mariadb-oqgraph-engine-10.5.22-1.fos23.aarch64.rpm mariadb-backup-10.5.22-1.fos23.aarch64.rpm mariadb-gssapi-server-10.5.22-1.fos23.aarch64.rpm mariadb-pam-10.5.22-1.fos23.aarch64.rpm mariadb-server-utils-10.5.22-1.fos23.aarch64.rpm mariadb-devel-10.5.22-1.fos23.aarch64.rpm mariadb-embedded-10.5.22-1.fos23.aarch64.rpm mariadb-embedded-devel-10.5.22-1.fos23.aarch64.rpm mariadb-test-10.5.22-1.fos23.aarch64.rpm FusionOS-SA-2023-2350 Important FusionOS CVE-2023-23583:Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege and/or information disclosure and/or denial of service via local access. FusionOS microcode_ctl-2.1-42.fos23.x86_64.rpm FusionOS-SA-2023-2351 Critical FusionOS CVE-2023-22068:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-38545:This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with. CVE-2023-22079:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22084:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.43 and prior, 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22064:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22078:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22066:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22113:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N). CVE-2023-22026:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.42 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22015:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.42 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22032:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22059:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22070:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22115:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22028:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.43 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22104:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22114:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22097:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22110:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22065:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22112:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22092:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22111:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22103:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22058:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.33 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22046:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22038:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N). CVE-2023-22053:Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.7.42 and prior and 8.0.33 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server and unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H). CVE-2023-22008:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22057:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22005:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.33 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22054:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22033:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.33 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22048:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are 8.0.33 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). CVE-2023-22056:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22007:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.41 and prior and 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-0215:The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. CVE-2022-43551:A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded. CVE-2023-21946:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21963:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are 5.7.40 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L). CVE-2023-21912:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 5.7.41 and prior and 8.0.30 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21945:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21933:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21935:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21982:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21955:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21929:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). CVE-2023-21966:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21913:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21980:Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.7.41 and prior and 8.0.32 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H). CVE-2023-21947:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21919:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21972:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21962:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21917:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21977:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21940:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21911:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21976:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21953:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21920:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-32221:When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST. CVE-2023-21836:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21871:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21865:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21872:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). CVE-2023-21867:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21873:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21864:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21870:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21874:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L). CVE-2023-21868:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21863:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21869:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). CVE-2023-21882:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N). CVE-2023-21881:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21883:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21887:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21880:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). CVE-2023-21879:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21875:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.31 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H). CVE-2023-21876:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21877:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). CVE-2023-21878:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21592:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 5.7.39 and prior and 8.0.29 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). CVE-2022-21641:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21638:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21635:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H). CVE-2022-21611:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.30 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21625:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21599:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21632:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21633:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-39400:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21640:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21608:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.39 and prior and 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21594:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21617:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are 5.7.39 and prior and 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21637:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21604:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-39410:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). CVE-2022-39408:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21569:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21526:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21528:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). CVE-2022-21525:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21531:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21537:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21538:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.29 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L). CVE-2022-21539:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.29 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 5.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L). CVE-2022-21509:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). CVE-2022-21553:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21529:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21534:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21515:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 5.7.38 and prior and 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21547:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Federated). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21522:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.29 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21527:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). CVE-2022-21530:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21517:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). FusionOS mysql-8.0.35-1.u1.fos23.x86_64.rpm mysql-libs-8.0.35-1.u1.fos23.x86_64.rpm mysql-config-8.0.35-1.u1.fos23.x86_64.rpm mysql-common-8.0.35-1.u1.fos23.x86_64.rpm mysql-errmsg-8.0.35-1.u1.fos23.x86_64.rpm mysql-server-8.0.35-1.u1.fos23.x86_64.rpm mysql-devel-8.0.35-1.u1.fos23.x86_64.rpm mysql-test-8.0.35-1.u1.fos23.x86_64.rpm mysql-help-8.0.35-1.u1.fos23.x86_64.rpm mysql-8.0.35-1.u1.fos23.aarch64.rpm mysql-libs-8.0.35-1.u1.fos23.aarch64.rpm mysql-config-8.0.35-1.u1.fos23.aarch64.rpm mysql-common-8.0.35-1.u1.fos23.aarch64.rpm mysql-errmsg-8.0.35-1.u1.fos23.aarch64.rpm mysql-server-8.0.35-1.u1.fos23.aarch64.rpm mysql-devel-8.0.35-1.u1.fos23.aarch64.rpm mysql-test-8.0.35-1.u1.fos23.aarch64.rpm mysql-help-8.0.35-1.u1.fos23.aarch64.rpm FusionOS-SA-2023-2352 Critical FusionOS CVE-2023-0464:A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. CVE-2023-2650:Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. CVE-2020-1971:The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the "-crl_download" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w). CVE-2021-23840:Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). CVE-2021-23841:The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). CVE-2021-3449:An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j). CVE-2021-3450:The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j). CVE-2021-3711:In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). CVE-2021-3712:ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y). CVE-2021-4160:There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH private key among multiple clients, which is no longer an option since CVE-2016-0701. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0.0. It was addressed in the releases of 1.1.1m and 3.0.1 on the 15th of December 2021. For the 1.0.2 release it is addressed in git commit 6fc1aaaf3 that is available to premium support customers only. It will be made available in 1.0.2zc when it is released. The issue only affects OpenSSL on MIPS platforms. Fixed in OpenSSL 3.0.1 (Affected 3.0.0). Fixed in OpenSSL 1.1.1m (Affected 1.1.1-1.1.1l). Fixed in OpenSSL 1.0.2zc-dev (Affected 1.0.2-1.0.2zb). CVE-2022-0778:The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc). CVE-2022-1292:The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd). CVE-2022-2068:In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze). CVE-2022-2097:AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p). CVE-2022-4450:The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. CVE-2023-0215:The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. CVE-2023-3817:Checking excessively long DH keys or parameters may be very slow. Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. CVE-2023-5678:Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Applications that use the functions DH_generate_key() togenerate an X9.42 DH key may experience long delays. Likewise, applicationsthat use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. FusionOS openresty-openssl111-asan-1.1.1h-2.u4.fos23.x86_64.rpm openresty-openssl111-asan-1.1.1h-2.u4.fos23.aarch64.rpm FusionOS-SA-2023-2353 Important FusionOS CVE-2023-43907:OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c. FusionOS optipng-0.7.8-1.fos23.x86_64.rpm optipng-0.7.8-1.fos23.aarch64.rpm FusionOS-SA-2023-2354 Important FusionOS CVE-2023-47038:A vulnerability was found in perl. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer. FusionOS perl-5.34.0-10.u4.fos23.x86_64.rpm perl-libs-5.34.0-10.u4.fos23.x86_64.rpm perl-devel-5.34.0-10.u4.fos23.x86_64.rpm perl-help-5.34.0-10.u4.fos23.noarch.rpm perl-5.34.0-10.u4.fos23.aarch64.rpm perl-libs-5.34.0-10.u4.fos23.aarch64.rpm perl-devel-5.34.0-10.u4.fos23.aarch64.rpm FusionOS-SA-2023-2355 Moderate FusionOS CVE-2020-36023:An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function. FusionOS poppler-0.90.0-7.u4.fos23.x86_64.rpm poppler-devel-0.90.0-7.u4.fos23.x86_64.rpm poppler-glib-0.90.0-7.u4.fos23.x86_64.rpm poppler-glib-devel-0.90.0-7.u4.fos23.x86_64.rpm poppler-glib-doc-0.90.0-7.u4.fos23.noarch.rpm poppler-qt5-0.90.0-7.u4.fos23.x86_64.rpm poppler-qt5-devel-0.90.0-7.u4.fos23.x86_64.rpm poppler-cpp-0.90.0-7.u4.fos23.x86_64.rpm poppler-cpp-devel-0.90.0-7.u4.fos23.x86_64.rpm poppler-utils-0.90.0-7.u4.fos23.x86_64.rpm poppler-help-0.90.0-7.u4.fos23.noarch.rpm poppler-0.90.0-7.u4.fos23.aarch64.rpm poppler-devel-0.90.0-7.u4.fos23.aarch64.rpm poppler-glib-0.90.0-7.u4.fos23.aarch64.rpm poppler-glib-devel-0.90.0-7.u4.fos23.aarch64.rpm poppler-qt5-0.90.0-7.u4.fos23.aarch64.rpm poppler-qt5-devel-0.90.0-7.u4.fos23.aarch64.rpm poppler-cpp-0.90.0-7.u4.fos23.aarch64.rpm poppler-cpp-devel-0.90.0-7.u4.fos23.aarch64.rpm poppler-utils-0.90.0-7.u4.fos23.aarch64.rpm FusionOS-SA-2023-2356 Important FusionOS CVE-2023-49083:cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6. CVE-2023-49083:cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6. FusionOS python3-cryptography-36.0.1-6.u5.fos23.x86_64.rpm python-cryptography-help-36.0.1-6.u5.fos23.noarch.rpm python3-cryptography-36.0.1-6.u5.fos23.aarch64.rpm FusionOS-SA-2023-2357 Important FusionOS CVE-2023-46136:Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1. FusionOS python3-werkzeug-2.0.3-4.u3.fos23.noarch.rpm python-werkzeug-help-2.0.3-4.u3.fos23.noarch.rpm FusionOS-SA-2023-2358 Moderate FusionOS CVE-2023-1544:A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU. FusionOS qemu-6.2.0-86.u12.fos23.x86_64.rpm qemu-guest-agent-6.2.0-86.u12.fos23.x86_64.rpm qemu-help-6.2.0-86.u12.fos23.noarch.rpm qemu-img-6.2.0-86.u12.fos23.x86_64.rpm qemu-block-rbd-6.2.0-86.u12.fos23.x86_64.rpm qemu-block-ssh-6.2.0-86.u12.fos23.x86_64.rpm qemu-block-iscsi-6.2.0-86.u12.fos23.x86_64.rpm qemu-block-curl-6.2.0-86.u12.fos23.x86_64.rpm qemu-hw-usb-host-6.2.0-86.u12.fos23.x86_64.rpm qemu-seabios-6.2.0-86.u12.fos23.x86_64.rpm qemu-system-aarch64-6.2.0-86.u12.fos23.x86_64.rpm qemu-system-arm-6.2.0-86.u12.fos23.x86_64.rpm qemu-system-x86_64-6.2.0-86.u12.fos23.x86_64.rpm qemu-system-riscv-6.2.0-86.u12.fos23.x86_64.rpm qemu-6.2.0-86.u12.fos23.aarch64.rpm qemu-guest-agent-6.2.0-86.u12.fos23.aarch64.rpm qemu-img-6.2.0-86.u12.fos23.aarch64.rpm qemu-block-rbd-6.2.0-86.u12.fos23.aarch64.rpm qemu-block-ssh-6.2.0-86.u12.fos23.aarch64.rpm qemu-block-iscsi-6.2.0-86.u12.fos23.aarch64.rpm qemu-block-curl-6.2.0-86.u12.fos23.aarch64.rpm qemu-hw-usb-host-6.2.0-86.u12.fos23.aarch64.rpm qemu-system-aarch64-6.2.0-86.u12.fos23.aarch64.rpm qemu-system-arm-6.2.0-86.u12.fos23.aarch64.rpm qemu-system-x86_64-6.2.0-86.u12.fos23.aarch64.rpm qemu-system-riscv-6.2.0-86.u12.fos23.aarch64.rpm FusionOS-SA-2023-2359 Important FusionOS CVE-2023-43114:An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. When using the GDI font engine, if a corrupted font is loaded via QFontDatabase::addApplicationFont{FromData], then it can cause the application to crash because of missing length checks. CVE-2023-38197:An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion. CVE-2023-37369:In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length. FusionOS qt-4.8.7-58.u7.fos23.x86_64.rpm qt-devel-4.8.7-58.u7.fos23.x86_64.rpm qt-4.8.7-58.u7.fos23.aarch64.rpm qt-devel-4.8.7-58.u7.fos23.aarch64.rpm FusionOS-SA-2023-2360 Important FusionOS CVE-2023-38197:An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion. CVE-2023-43114:An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. When using the GDI font engine, if a corrupted font is loaded via QFontDatabase::addApplicationFont{FromData], then it can cause the application to crash because of missing length checks. FusionOS qt5-qtbase-5.15.2-13.u6.fos23.x86_64.rpm qt5-qtbase-common-5.15.2-13.u6.fos23.noarch.rpm qt5-qtbase-devel-5.15.2-13.u6.fos23.x86_64.rpm qt5-qtbase-private-devel-5.15.2-13.u6.fos23.x86_64.rpm qt5-qtbase-examples-5.15.2-13.u6.fos23.x86_64.rpm qt5-qtbase-static-5.15.2-13.u6.fos23.x86_64.rpm qt5-qtbase-mysql-5.15.2-13.u6.fos23.x86_64.rpm qt5-qtbase-odbc-5.15.2-13.u6.fos23.x86_64.rpm qt5-qtbase-postgresql-5.15.2-13.u6.fos23.x86_64.rpm qt5-qtbase-gui-5.15.2-13.u6.fos23.x86_64.rpm qt5-qtbase-5.15.2-13.u6.fos23.aarch64.rpm qt5-qtbase-devel-5.15.2-13.u6.fos23.aarch64.rpm qt5-qtbase-private-devel-5.15.2-13.u6.fos23.aarch64.rpm qt5-qtbase-examples-5.15.2-13.u6.fos23.aarch64.rpm qt5-qtbase-static-5.15.2-13.u6.fos23.aarch64.rpm qt5-qtbase-mysql-5.15.2-13.u6.fos23.aarch64.rpm qt5-qtbase-odbc-5.15.2-13.u6.fos23.aarch64.rpm qt5-qtbase-postgresql-5.15.2-13.u6.fos23.aarch64.rpm qt5-qtbase-gui-5.15.2-13.u6.fos23.aarch64.rpm FusionOS-SA-2023-2361 Moderate FusionOS CVE-2023-25155:Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. This problem affects all Redis versions. Patches were released in Redis version(s) 6.0.18, 6.2.11 and 7.0.9. CVE-2023-45145:Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory. FusionOS redis5-5.0.7-6.u6.fos23.x86_64.rpm redis5-devel-5.0.7-6.u6.fos23.x86_64.rpm redis5-doc-5.0.7-6.u6.fos23.noarch.rpm redis5-5.0.7-6.u6.fos23.aarch64.rpm redis5-devel-5.0.7-6.u6.fos23.aarch64.rpm FusionOS-SA-2023-2362 Critical FusionOS CVE-2023-29824:A use-after-free issue was discovered in Py_FindObjects() function in SciPy versions prior to 1.8.0. NOTE: the vendor and discoverer indicate that this is not a security issue. FusionOS python3-scipy-1.6.2-2.u2.fos23.x86_64.rpm python3-scipy-1.6.2-2.u2.fos23.aarch64.rpm FusionOS-SA-2023-2363 Moderate FusionOS CVE-2023-0465:Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. CVE-2023-2650:Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. CVE-2023-3446:Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. FusionOS shim-15.6-12.u9.fos23.x86_64.rpm shim-15.6-12.u9.fos23.aarch64.rpm FusionOS-SA-2023-2364 Moderate FusionOS CVE-2018-11039:Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack. CVE-2022-22950:n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition. FusionOS springframework-3.2.18-12.u2.fos23.noarch.rpm springframework-help-3.2.18-12.u2.fos23.noarch.rpm springframework-aop-3.2.18-12.u2.fos23.noarch.rpm springframework-beans-3.2.18-12.u2.fos23.noarch.rpm springframework-context-3.2.18-12.u2.fos23.noarch.rpm springframework-expression-3.2.18-12.u2.fos23.noarch.rpm springframework-instrument-3.2.18-12.u2.fos23.noarch.rpm springframework-jdbc-3.2.18-12.u2.fos23.noarch.rpm springframework-jms-3.2.18-12.u2.fos23.noarch.rpm springframework-orm-3.2.18-12.u2.fos23.noarch.rpm springframework-orm-hibernate4-3.2.18-12.u2.fos23.noarch.rpm springframework-oxm-3.2.18-12.u2.fos23.noarch.rpm springframework-tx-3.2.18-12.u2.fos23.noarch.rpm springframework-web-3.2.18-12.u2.fos23.noarch.rpm FusionOS-SA-2023-2365 Important FusionOS CVE-2023-49285:Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-49286:Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. FusionOS squid-4.9-21.u2.fos23.x86_64.rpm squid-4.9-21.u2.fos23.aarch64.rpm FusionOS-SA-2023-2366 Low FusionOS CVE-2023-39804:A stack overflow vulnerability exists in GNU Tar up to including v1.34. The bug exists in the function xattr_decoder() in xheader.c, where alloca() is used and it may overflow the stack if a sufficiently long xattr key is used. The vulnerability can be triggered when extracting a tar/pax archive that contains such a long xattr key. FusionOS tar-1.34-5.u2.fos23.x86_64.rpm tar-help-1.34-5.u2.fos23.noarch.rpm tar-1.34-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2367 Important FusionOS CVE-2023-46589:Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. CVE-2023-42795:Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. CVE-2023-44487:The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. FusionOS tomcat-9.0.10-32.u11.fos23.noarch.rpm tomcat-jsvc-9.0.10-32.u11.fos23.noarch.rpm tomcat-help-9.0.10-32.u11.fos23.noarch.rpm FusionOS-SA-2023-2368 Moderate FusionOS CVE-2023-48706:Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call causes free-ing of memory which may later then be accessed by the initial `:s` command. The user must intentionally execute the payload and the whole process is a bit tricky to do since it seems to work only reliably for the very first :s command. It may also cause a crash of Vim. Version 9.0.2121 contains a fix for this issue. CVE-2023-48231:Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be viable. This issue has been addressed in commit `25aabc2b` which has been included in release version 9.0.2106. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-48233:Vim is an open source command line text editor. If the count after the :s command is larger than what fits into a (signed) long variable, abort with e_value_too_large. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `ac6378773` which has been included in release version 9.0.2108. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-48234:Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `58f9befca1` which has been included in release version 9.0.2109. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-48235:Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an overflow. Ironically this happens in the existing overflow check, because the line number becomes negative and LONG_MAX - lnum will cause the overflow. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `060623e` which has been included in release version 9.0.2110. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-48236:Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger than MAX_INT. Impact is low, user interaction is required and a crash may not even happen in all situations. This vulnerability has been addressed in commit `73b2d379` which has been included in release version 9.0.2111. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-48237:Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `6bf131888` which has been included in version 9.0.2112. Users are advised to upgrade. There are no known workarounds for this vulnerability. FusionOS vim-common-9.0-23.u13.fos23.x86_64.rpm vim-minimal-9.0-23.u13.fos23.x86_64.rpm vim-enhanced-9.0-23.u13.fos23.x86_64.rpm vim-filesystem-9.0-23.u13.fos23.noarch.rpm vim-X11-9.0-23.u13.fos23.x86_64.rpm vim-common-9.0-23.u13.fos23.aarch64.rpm vim-minimal-9.0-23.u13.fos23.aarch64.rpm vim-enhanced-9.0-23.u13.fos23.aarch64.rpm vim-X11-9.0-23.u13.fos23.aarch64.rpm FusionOS-SA-2023-2369 Moderate FusionOS CVE-2023-6175:A heap-based buffer overflow was found in Wireshark's NetScreen file parser. This issue may allow local arbitrary code execution via a crafted capture file. FusionOS wireshark-3.6.14-5.u8.fos23.x86_64.rpm wireshark-devel-3.6.14-5.u8.fos23.x86_64.rpm wireshark-help-3.6.14-5.u8.fos23.x86_64.rpm wireshark-3.6.14-5.u8.fos23.aarch64.rpm wireshark-devel-3.6.14-5.u8.fos23.aarch64.rpm wireshark-help-3.6.14-5.u8.fos23.aarch64.rpm FusionOS-SA-2024-2001 Important FusionOS CVE-2023-45866:Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue. CVE-2023-50229:VUL-0: CVE-2023-50229: bluez: BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. CVE-2023-50230:VUL-0: CVE-2023-50230: bluez: BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. FusionOS bluez-5.54-19.u3.fos23.x86_64.rpm bluez-libs-5.54-19.u3.fos23.x86_64.rpm bluez-devel-5.54-19.u3.fos23.x86_64.rpm bluez-help-5.54-19.u3.fos23.noarch.rpm bluez-cups-5.54-19.u3.fos23.x86_64.rpm bluez-5.54-19.u3.fos23.aarch64.rpm bluez-libs-5.54-19.u3.fos23.aarch64.rpm bluez-devel-5.54-19.u3.fos23.aarch64.rpm bluez-cups-5.54-19.u3.fos23.aarch64.rpm FusionOS-SA-2024-2002 Important FusionOS CVE-2023-50471:cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c. CVE-2023-50472:cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c. FusionOS cjson-1.7.15-2.u1.fos23.x86_64.rpm cjson-devel-1.7.15-2.u1.fos23.x86_64.rpm cjson-1.7.15-2.u1.fos23.aarch64.rpm cjson-devel-1.7.15-2.u1.fos23.aarch64.rpm FusionOS-SA-2024-2003 Critical FusionOS CVE-2022-37026:In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS. FusionOS erlang-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-asn1-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-common_test-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-compiler-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-crypto-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-debugger-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-dialyzer-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-diameter-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-edoc-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-eldap-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-erl_docgen-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-erl_interface-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-erts-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-et-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-eunit-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-examples-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-ftp-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-hipe-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-inets-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-jinterface-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-kernel-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-megaco-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-mnesia-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-observer-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-odbc-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-os_mon-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-parsetools-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-public_key-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-reltool-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-runtime_tools-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-sasl-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-snmp-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-ssh-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-ssl-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-stdlib-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-syntax_tools-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-tftp-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-tools-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-wx-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-xmerl-23.3.4.9-3.u1.fos23.x86_64.rpm erlang-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-asn1-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-common_test-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-compiler-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-crypto-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-debugger-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-dialyzer-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-diameter-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-edoc-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-eldap-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-erl_docgen-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-erl_interface-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-erts-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-et-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-eunit-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-examples-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-ftp-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-hipe-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-inets-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-jinterface-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-kernel-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-megaco-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-mnesia-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-observer-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-odbc-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-os_mon-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-parsetools-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-public_key-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-reltool-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-runtime_tools-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-sasl-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-snmp-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-ssh-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-ssl-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-stdlib-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-syntax_tools-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-tftp-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-tools-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-wx-23.3.4.9-3.u1.fos23.aarch64.rpm erlang-xmerl-23.3.4.9-3.u1.fos23.aarch64.rpm FusionOS-SA-2024-2004 Moderate FusionOS CVE-2023-49990:Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c. CVE-2023-49991:Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c. CVE-2023-49992:Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Overflow via the function RemoveEnding at dictionary.c. CVE-2023-49993:Espeak-ng 1.52-dev was discovered to contain a Buffer Overflow via the function ReadClause at readclause.c. CVE-2023-49994:Espeak-ng 1.52-dev was discovered to contain a Floating Point Exception via the function PeaksToHarmspect at wavegen.c. FusionOS espeak-ng-1.51-2.fos23.x86_64.rpm espeak-ng-devel-1.51-2.fos23.x86_64.rpm espeak-ng-help-1.51-2.fos23.noarch.rpm espeak-ng-1.51-2.fos23.aarch64.rpm espeak-ng-devel-1.51-2.fos23.aarch64.rpm FusionOS-SA-2024-2005 Important FusionOS CVE-2023-44446:A use-after-free flaw was found in the MXF demuxer in GStreamer when handling certain MXF video files. This issue could allow a malicious third party to trigger a crash in the application and may allow code execution. CVE-2023-37329:Heap-based buffer overflow in the PGS blu-ray subtitle decoder when handling certain files in GStreamer versions before 1.22.4 / 1.20.7. It is possible for a malicious third party to trigger a crash in the application, and possibly also effect code execution through heap manipulation.https://gstreamer.freedesktop.org/security/sa-2023-0003.html FusionOS gstreamer1-plugins-bad-free-1.16.2-9.u3.fos23.x86_64.rpm gstreamer1-plugins-bad-free-devel-1.16.2-9.u3.fos23.x86_64.rpm gstreamer1-plugins-bad-free-1.16.2-9.u3.fos23.aarch64.rpm gstreamer1-plugins-bad-free-devel-1.16.2-9.u3.fos23.aarch64.rpm FusionOS-SA-2024-2006 Moderate FusionOS CVE-2023-22742:libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the `certificate_check` field of libgit2's `git_remote_callbacks` structure - if a certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default - without configuring a certificate check callback, clients will not perform validation on the server SSH keys and may be subject to a man-in-the-middle attack. Users are encouraged to upgrade to v1.4.5 or v1.5.1. Users unable to upgrade should ensure that all relevant certificates are manually checked. FusionOS libgit2-1.3.2-2.u1.fos23.x86_64.rpm libgit2-devel-1.3.2-2.u1.fos23.x86_64.rpm libgit2-1.3.2-2.u1.fos23.aarch64.rpm libgit2-devel-1.3.2-2.u1.fos23.aarch64.rpm FusionOS-SA-2024-2007 Important FusionOS CVE-2022-26592:Stack Overflow vulnerability in libsass 3.6.5 via the CompoundSelector::has_real_parent_ref function. CVE-2022-43358:Stack overflow vulnerability in ast_selectors.cpp: in function Sass::ComplexSelector::has_placeholder in libsass:3.6.5-8-g210218, which can be exploited by attackers to cause a denial of service (DoS). CVE-2022-43357:Stack overflow vulnerability in ast_selectors.cpp in function Sass::CompoundSelector::has_real_parent_ref in libsass:3.6.5-8-g210218, which can be exploited by attackers to causea denial of service (DoS). Also affects the command line driver for libsass, sassc 3.6.2. FusionOS libsass-3.6.4-2.u1.fos23.x86_64.rpm libsass-devel-3.6.4-2.u1.fos23.x86_64.rpm libsass-3.6.4-2.u1.fos23.aarch64.rpm libsass-devel-3.6.4-2.u1.fos23.aarch64.rpm FusionOS-SA-2024-2008 Moderate FusionOS CVE-2023-6004:A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter. CVE-2023-6918:A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection. FusionOS libssh-0.9.6-8.u3.fos23.x86_64.rpm libssh-devel-0.9.6-8.u3.fos23.x86_64.rpm libssh-help-0.9.6-8.u3.fos23.noarch.rpm libssh-0.9.6-8.u3.fos23.aarch64.rpm libssh-devel-0.9.6-8.u3.fos23.aarch64.rpm FusionOS-SA-2024-2009 Important FusionOS CVE-2023-6378:A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data. CVE-2023-6481:A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data. FusionOS logback-1.2.8-3.u1.fos23.noarch.rpm logback-help-1.2.8-3.u1.fos23.noarch.rpm logback-access-1.2.8-3.u1.fos23.noarch.rpm logback-examples-1.2.8-3.u1.fos23.noarch.rpm FusionOS-SA-2024-2010 Important FusionOS CVE-2023-7104:A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999. FusionOS sqlite-3.37.2-7.u4.fos23.x86_64.rpm sqlite-devel-3.37.2-7.u4.fos23.x86_64.rpm sqlite-help-3.37.2-7.u4.fos23.noarch.rpm sqlite-3.37.2-7.u4.fos23.aarch64.rpm sqlite-devel-3.37.2-7.u4.fos23.aarch64.rpm FusionOS-SA-2024-2011 Important FusionOS CVE-2023-50269:Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. FusionOS squid-4.9-22.u3.fos23.x86_64.rpm squid-4.9-22.u3.fos23.aarch64.rpm FusionOS-SA-2024-2012 Critical FusionOS CVE-2023-41913:strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message. FusionOS strongswan-5.9.7-5.u2.fos23.x86_64.rpm strongswan-libipsec-5.9.7-5.u2.fos23.x86_64.rpm strongswan-charon-nm-5.9.7-5.u2.fos23.x86_64.rpm strongswan-sqlite-5.9.7-5.u2.fos23.x86_64.rpm strongswan-tnc-imcvs-5.9.7-5.u2.fos23.x86_64.rpm strongswan-5.9.7-5.u2.fos23.aarch64.rpm strongswan-libipsec-5.9.7-5.u2.fos23.aarch64.rpm strongswan-charon-nm-5.9.7-5.u2.fos23.aarch64.rpm strongswan-sqlite-5.9.7-5.u2.fos23.aarch64.rpm strongswan-tnc-imcvs-5.9.7-5.u2.fos23.aarch64.rpm FusionOS-SA-2024-2013 Important FusionOS CVE-2023-42465:Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit. FusionOS sudo-1.9.8p2-15.u8.fos23.x86_64.rpm sudo-devel-1.9.8p2-15.u8.fos23.x86_64.rpm sudo-help-1.9.8p2-15.u8.fos23.noarch.rpm sudo-1.9.8p2-15.u8.fos23.aarch64.rpm sudo-devel-1.9.8p2-15.u8.fos23.aarch64.rpm FusionOS-SA-2024-2014 Moderate FusionOS CVE-2023-7008:A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records. FusionOS systemd-249-63.u16.fos23.x86_64.rpm systemd-devel-249-63.u16.fos23.x86_64.rpm systemd-libs-249-63.u16.fos23.x86_64.rpm systemd-udev-249-63.u16.fos23.x86_64.rpm systemd-container-249-63.u16.fos23.x86_64.rpm systemd-resolved-249-63.u16.fos23.x86_64.rpm systemd-nspawn-249-63.u16.fos23.x86_64.rpm systemd-networkd-249-63.u16.fos23.x86_64.rpm systemd-timesyncd-249-63.u16.fos23.x86_64.rpm systemd-pam-249-63.u16.fos23.x86_64.rpm systemd-help-249-63.u16.fos23.noarch.rpm systemd-249-63.u16.fos23.aarch64.rpm systemd-devel-249-63.u16.fos23.aarch64.rpm systemd-libs-249-63.u16.fos23.aarch64.rpm systemd-udev-249-63.u16.fos23.aarch64.rpm systemd-container-249-63.u16.fos23.aarch64.rpm systemd-resolved-249-63.u16.fos23.aarch64.rpm systemd-nspawn-249-63.u16.fos23.aarch64.rpm systemd-networkd-249-63.u16.fos23.aarch64.rpm systemd-timesyncd-249-63.u16.fos23.aarch64.rpm systemd-pam-249-63.u16.fos23.aarch64.rpm FusionOS-SA-2024-2015 Important FusionOS CVE-2022-4065:A vulnerability was found in cbeust testng 7.5.0/7.6.0/7.6.1/7.7.0. It has been declared as critical. Affected by this vulnerability is the function testngXmlExistsInJar of the file testng-core/src/main/java/org/testng/JarFileUtils.java of the component XML File Parser. The manipulation leads to path traversal. The attack can be launched remotely. Upgrading to version 7.5.1 and 7.7.1 is able to address this issue. The patch is named 9150736cd2c123a6a3b60e6193630859f9f0422b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-214027. FusionOS testng-6.14.3-7.u1.fos23.noarch.rpm testng-javadoc-6.14.3-7.u1.fos23.noarch.rpm FusionOS-SA-2024-2016 Critical FusionOS CVE-2021-33391:An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c. FusionOS tidy-5.7.28-2.u1.fos23.x86_64.rpm libtidy-5.7.28-2.u1.fos23.x86_64.rpm libtidy-devel-5.7.28-2.u1.fos23.x86_64.rpm tidy-help-5.7.28-2.u1.fos23.noarch.rpm tidy-5.7.28-2.u1.fos23.aarch64.rpm libtidy-5.7.28-2.u1.fos23.aarch64.rpm libtidy-devel-5.7.28-2.u1.fos23.aarch64.rpm FusionOS-SA-2024-2017 Important FusionOS CVE-2023-6478:A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information. CVE-2023-6377:A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved. FusionOS xorg-x11-server-1.20.11-24.u11.fos23.x86_64.rpm xorg-x11-server-common-1.20.11-24.u11.fos23.x86_64.rpm xorg-x11-server-Xnest-1.20.11-24.u11.fos23.x86_64.rpm xorg-x11-server-Xdmx-1.20.11-24.u11.fos23.x86_64.rpm xorg-x11-server-Xvfb-1.20.11-24.u11.fos23.x86_64.rpm xorg-x11-server-Xephyr-1.20.11-24.u11.fos23.x86_64.rpm xorg-x11-server-devel-1.20.11-24.u11.fos23.x86_64.rpm xorg-x11-server-help-1.20.11-24.u11.fos23.noarch.rpm xorg-x11-server-source-1.20.11-24.u11.fos23.noarch.rpm xorg-x11-server-1.20.11-24.u11.fos23.aarch64.rpm xorg-x11-server-common-1.20.11-24.u11.fos23.aarch64.rpm xorg-x11-server-Xnest-1.20.11-24.u11.fos23.aarch64.rpm xorg-x11-server-Xdmx-1.20.11-24.u11.fos23.aarch64.rpm xorg-x11-server-Xvfb-1.20.11-24.u11.fos23.aarch64.rpm xorg-x11-server-Xephyr-1.20.11-24.u11.fos23.aarch64.rpm xorg-x11-server-devel-1.20.11-24.u11.fos23.aarch64.rpm FusionOS-SA-2024-2018 Low FusionOS CVE-2023-31975:yasm v1.3.0 was discovered to contain a memory leak via the function yasm_intnum_copy at /libyasm/intnum.c. FusionOS yasm-1.3.0-12.u3.fos23.x86_64.rpm yasm-1.3.0-12.u3.fos23.aarch64.rpm FusionOS-SA-2024-2019 Moderate FusionOS CVE-2024-0690:An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. It was discovered that information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values. FusionOS ansible-2.9.27-4.u4.fos23.noarch.rpm ansible-help-2.9.27-4.u4.fos23.noarch.rpm FusionOS-SA-2024-2020 Moderate FusionOS CVE-2023-35887:Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the rooted tree via paths including parent navigation ("..") beyond the root, or involving symlinks. This issue affects Apache MINA: from 1.0 before 2.10. Users are recommended to upgrade to 2.10 FusionOS apache-sshd-2.9.2-2.u1.fos23.noarch.rpm apache-sshd-javadoc-2.9.2-2.u1.fos23.noarch.rpm FusionOS-SA-2024-2021 Critical FusionOS CVE-2024-22211:FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out of bound read/write. Data extraction over network is not possible, the buffers are used to display an image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are no know workarounds for this vulnerability. FusionOS freerdp-2.11.1-2.u1.fos23.x86_64.rpm freerdp-devel-2.11.1-2.u1.fos23.x86_64.rpm libwinpr-2.11.1-2.u1.fos23.x86_64.rpm libwinpr-devel-2.11.1-2.u1.fos23.x86_64.rpm freerdp-help-2.11.1-2.u1.fos23.x86_64.rpm freerdp-2.11.1-2.u1.fos23.aarch64.rpm freerdp-devel-2.11.1-2.u1.fos23.aarch64.rpm libwinpr-2.11.1-2.u1.fos23.aarch64.rpm libwinpr-devel-2.11.1-2.u1.fos23.aarch64.rpm freerdp-help-2.11.1-2.u1.fos23.aarch64.rpm FusionOS-SA-2024-2022 Important FusionOS CVE-2024-0553:A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981. CVE-2024-0567:A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack. FusionOS gnutls-3.7.2-10.u5.fos23.x86_64.rpm gnutls-devel-3.7.2-10.u5.fos23.x86_64.rpm gnutls-utils-3.7.2-10.u5.fos23.x86_64.rpm gnutls-help-3.7.2-10.u5.fos23.noarch.rpm gnutls-3.7.2-10.u5.fos23.aarch64.rpm gnutls-devel-3.7.2-10.u5.fos23.aarch64.rpm gnutls-utils-3.7.2-10.u5.fos23.aarch64.rpm FusionOS-SA-2024-2023 Important FusionOS CVE-2023-46045:Graphviz 2.36 before 10.0.0 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root. FusionOS graphviz-2.48.0-5.u1.fos23.x86_64.rpm graphviz-devel-2.48.0-5.u1.fos23.x86_64.rpm graphviz-docs-2.48.0-5.u1.fos23.x86_64.rpm graphviz-gd-2.48.0-5.u1.fos23.x86_64.rpm graphviz-graphs-2.48.0-5.u1.fos23.x86_64.rpm graphviz-guile-2.48.0-5.u1.fos23.x86_64.rpm graphviz-java-2.48.0-5.u1.fos23.x86_64.rpm graphviz-lua-2.48.0-5.u1.fos23.x86_64.rpm graphviz-ocaml-2.48.0-5.u1.fos23.x86_64.rpm graphviz-perl-2.48.0-5.u1.fos23.x86_64.rpm graphviz-ruby-2.48.0-5.u1.fos23.x86_64.rpm graphviz-tcl-2.48.0-5.u1.fos23.x86_64.rpm graphviz-python3-2.48.0-5.u1.fos23.x86_64.rpm graphviz-2.48.0-5.u1.fos23.aarch64.rpm graphviz-devel-2.48.0-5.u1.fos23.aarch64.rpm graphviz-docs-2.48.0-5.u1.fos23.aarch64.rpm graphviz-gd-2.48.0-5.u1.fos23.aarch64.rpm graphviz-graphs-2.48.0-5.u1.fos23.aarch64.rpm graphviz-guile-2.48.0-5.u1.fos23.aarch64.rpm graphviz-java-2.48.0-5.u1.fos23.aarch64.rpm graphviz-lua-2.48.0-5.u1.fos23.aarch64.rpm graphviz-ocaml-2.48.0-5.u1.fos23.aarch64.rpm graphviz-perl-2.48.0-5.u1.fos23.aarch64.rpm graphviz-ruby-2.48.0-5.u1.fos23.aarch64.rpm graphviz-tcl-2.48.0-5.u1.fos23.aarch64.rpm graphviz-python3-2.48.0-5.u1.fos23.aarch64.rpm FusionOS-SA-2024-2024 Critical FusionOS CVE-2022-41853:Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled. FusionOS hsqldb1-1.8.1.3-3.u1.fos23.noarch.rpm hsqldb1-javadoc-1.8.1.3-3.u1.fos23.noarch.rpm FusionOS-SA-2024-2025 Moderate FusionOS CVE-2020-13956:Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution. FusionOS httpcomponents-client-4.5.5-7.u1.fos23.noarch.rpm httpcomponents-client-cache-4.5.5-7.u1.fos23.noarch.rpm httpcomponents-client-help-4.5.5-7.u1.fos23.noarch.rpm FusionOS-SA-2024-2026 Moderate FusionOS CVE-2024-0911:A flaw was found in indent, a program for formatting C code. This issue may allow an attacker to trick a user into processing a specially crafted file to trigger a heap-based buffer overflow, causing the application to crash. FusionOS indent-2.2.11-30.u2.fos23.x86_64.rpm indent-help-2.2.11-30.u2.fos23.noarch.rpm indent-2.2.11-30.u2.fos23.aarch64.rpm FusionOS-SA-2024-2027 Important FusionOS CVE-2024-20922:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u391; Oracle GraalVM Enterprise Edition: 20.3.12 and 21.3.8. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 2.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N). CVE-2024-20918:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). CVE-2024-20945:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). CVE-2024-20952:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). CVE-2024-20926:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21; Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). CVE-2024-20925:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u391; Oracle GraalVM Enterprise Edition: 20.3.12 and 21.3.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N). CVE-2024-20919:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). CVE-2024-20921:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). CVE-2024-20923:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u391; Oracle GraalVM Enterprise Edition: 20.3.12 and 21.3.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). FusionOS java-1.8.0-openjdk-1.8.0.402.b06-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-slowdebug-1.8.0.402.b06-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-headless-1.8.0.402.b06-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-headless-slowdebug-1.8.0.402.b06-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-devel-1.8.0.402.b06-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-devel-slowdebug-1.8.0.402.b06-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-demo-1.8.0.402.b06-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-demo-slowdebug-1.8.0.402.b06-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-src-1.8.0.402.b06-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-src-slowdebug-1.8.0.402.b06-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-javadoc-1.8.0.402.b06-0.u1.fos23.noarch.rpm java-1.8.0-openjdk-javadoc-zip-1.8.0.402.b06-0.u1.fos23.noarch.rpm java-1.8.0-openjdk-accessibility-1.8.0.402.b06-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.402.b06-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-1.8.0.402.b06-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-devel-1.8.0.402.b06-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-slowdebug-1.8.0.402.b06-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.402.b06-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-1.8.0.402.b06-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-slowdebug-1.8.0.402.b06-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-headless-1.8.0.402.b06-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-headless-slowdebug-1.8.0.402.b06-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-devel-1.8.0.402.b06-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-devel-slowdebug-1.8.0.402.b06-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-demo-1.8.0.402.b06-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-demo-slowdebug-1.8.0.402.b06-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-src-1.8.0.402.b06-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-src-slowdebug-1.8.0.402.b06-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-accessibility-1.8.0.402.b06-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.402.b06-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-1.8.0.402.b06-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-devel-1.8.0.402.b06-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-slowdebug-1.8.0.402.b06-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.402.b06-0.u1.fos23.aarch64.rpm FusionOS-SA-2024-2028 Important FusionOS CVE-2023-4759:Arbitrary File Overwrite in Eclipse JGit <= 6.6.0 In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive filesystem, or when a checkout from a clone of such a repository is performed on a case-insensitive filesystem. This can happen on checkout (DirCacheCheckout), merge (ResolveMerger via its WorkingTreeUpdater), pull (PullCommand using merge), and when applying a patch (PatchApplier). This can be exploited for remote code execution (RCE), for instance if the file written outside the working tree is a git filter that gets executed on a subsequent git command. The issue occurs only on case-insensitive filesystems, like the default filesystems on Windows and macOS. The user performing the clone or checkout must have the rights to create symbolic links for the problem to occur, and symbolic links must be enabled in the git configuration. Setting git configuration option core.symlinks = false before checking out avoids the problem. The issue was fixed in Eclipse JGit version 6.6.1.202309021850-r and 6.7.0.202309050840-r, available via Maven Central https://repo1.maven.org/maven2/org/eclipse/jgit/  and repo.eclipse.org https://repo.eclipse.org/content/repositories/jgit-releases/ . A backport is available in 5.13.3 starting from 5.13.3.202401111512-r. The JGit maintainers would like to thank RyotaK for finding and reporting this issue. FusionOS jgit-5.11.0-3.u1.fos23.noarch.rpm jgit-javadoc-5.11.0-3.u1.fos23.noarch.rpm FusionOS-SA-2024-2029 Important FusionOS CVE-2023-6932:A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread. We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1. CVE-2023-6817:A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free. We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a. CVE-2023-6546:A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This could allow a local unprivileged user to escalate their privileges on the system. CVE-2023-6931:A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group(). We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b. CVE-2023-6610:An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information. CVE-2023-6606:An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information. CVE-2023-35827:An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in drivers/net/ethernet/renesas/ravb_main.c. CVE-2023-51780:An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because of a vcc_recvmsg race condition. CVE-2021-33631:Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (filesystem modules) allows Forced Integer Overflow.This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3, from 5.10.0-60.18.0 before 5.10.0-183.0.0. CVE-2023-51781:An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-after-free because of an atalk_recvmsg race condition. CVE-2023-51782:An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose/af_rose.c has a use-after-free because of a rose_accept race condition. CVE-2023-6121:An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg). CVE-2023-51779:A flaw was found in the Bluetooth subsystem of the Linux kernel. A race condition between the bt_sock_recvmsg() and bt_sock_ioctl() functions could lead to a use-after-free on a socket buffer ("skb"). This flaw allows a local user to cause a denial of service condition or potential code execution. CVE-2023-6610:An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information. FusionOS kernel-5.10.0-136.60.0.139.u98.fos23.x86_64.rpm kernel-headers-5.10.0-136.60.0.139.u98.fos23.x86_64.rpm kernel-devel-5.10.0-136.60.0.139.u98.fos23.x86_64.rpm kernel-tools-5.10.0-136.60.0.139.u98.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.60.0.139.u98.fos23.x86_64.rpm perf-5.10.0-136.60.0.139.u98.fos23.x86_64.rpm python3-perf-5.10.0-136.60.0.139.u98.fos23.x86_64.rpm bpftool-5.10.0-136.60.0.139.u98.fos23.x86_64.rpm kernel-5.10.0-136.60.0.139.u98.fos23.aarch64.rpm kernel-headers-5.10.0-136.60.0.139.u98.fos23.aarch64.rpm kernel-devel-5.10.0-136.60.0.139.u98.fos23.aarch64.rpm kernel-tools-5.10.0-136.60.0.139.u98.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.60.0.139.u98.fos23.aarch64.rpm perf-5.10.0-136.60.0.139.u98.fos23.aarch64.rpm python3-perf-5.10.0-136.60.0.139.u98.fos23.aarch64.rpm bpftool-5.10.0-136.60.0.139.u98.fos23.aarch64.rpm FusionOS-SA-2024-2030 Critical FusionOS CVE-2024-24577:libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_index_add` can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the `has_dir_name` function in `src/libgit2/index.c`, which frees an entry that should not be freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary code execution. This issue has been patched in version 1.6.5 and 1.7.2. FusionOS libgit2-1.3.2-3.u2.fos23.x86_64.rpm libgit2-devel-1.3.2-3.u2.fos23.x86_64.rpm libgit2-1.3.2-3.u2.fos23.aarch64.rpm libgit2-devel-1.3.2-3.u2.fos23.aarch64.rpm FusionOS-SA-2024-2031 Important FusionOS CVE-2022-26981:Liblouis through 3.21.0 has a buffer overflow in compilePassOpcode in compileTranslationTable.c (called, indirectly, by tools/lou_checktable.c). CVE-2022-31783:Liblouis 3.21.0 has an out-of-bounds write in compileRule in compileTranslationTable.c, as demonstrated by lou_trace. CVE-2023-26767:Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of service via the lou_logFile function at logginc.c endpoint. CVE-2023-26768:Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of service via the compileTranslationTable.c and lou_setDataPath functions. FusionOS liblouis-3.7.0-6.u3.fos23.x86_64.rpm liblouis-devel-3.7.0-6.u3.fos23.x86_64.rpm liblouis-utils-3.7.0-6.u3.fos23.x86_64.rpm liblouis-help-3.7.0-6.u3.fos23.noarch.rpm python3-louis-3.7.0-6.u3.fos23.noarch.rpm liblouis-3.7.0-6.u3.fos23.aarch64.rpm liblouis-devel-3.7.0-6.u3.fos23.aarch64.rpm liblouis-utils-3.7.0-6.u3.fos23.aarch64.rpm FusionOS-SA-2024-2032 Important FusionOS CVE-2024-25062:An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free. FusionOS libxml2-2.9.14-10.u5.fos23.x86_64.rpm libxml2-devel-2.9.14-10.u5.fos23.x86_64.rpm python3-libxml2-2.9.14-10.u5.fos23.x86_64.rpm libxml2-help-2.9.14-10.u5.fos23.noarch.rpm libxml2-2.9.14-10.u5.fos23.aarch64.rpm libxml2-devel-2.9.14-10.u5.fos23.aarch64.rpm python3-libxml2-2.9.14-10.u5.fos23.aarch64.rpm FusionOS-SA-2024-2033 Moderate FusionOS CVE-2023-45918:ncurses 6.4-20230610 has a NULL pointer dereference in tgetstr in tinfo/lib_termcap.c. CVE-2023-50495:NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry(). FusionOS ncurses-6.3-10.u5.fos23.x86_64.rpm ncurses-base-6.3-10.u5.fos23.noarch.rpm ncurses-libs-6.3-10.u5.fos23.x86_64.rpm ncurses-devel-6.3-10.u5.fos23.x86_64.rpm ncurses-compat-libs-6.3-10.u5.fos23.x86_64.rpm ncurses-static-6.3-10.u5.fos23.x86_64.rpm ncurses-help-6.3-10.u5.fos23.x86_64.rpm ncurses-6.3-10.u5.fos23.aarch64.rpm ncurses-libs-6.3-10.u5.fos23.aarch64.rpm ncurses-devel-6.3-10.u5.fos23.aarch64.rpm ncurses-compat-libs-6.3-10.u5.fos23.aarch64.rpm ncurses-static-6.3-10.u5.fos23.aarch64.rpm ncurses-help-6.3-10.u5.fos23.aarch64.rpm FusionOS-SA-2024-2034 Moderate FusionOS CVE-2023-48795:The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust. CVE-2023-51385:In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name. FusionOS openssh-8.8p1-26.u15.fos23.x86_64.rpm openssh-clients-8.8p1-26.u15.fos23.x86_64.rpm openssh-server-8.8p1-26.u15.fos23.x86_64.rpm openssh-keycat-8.8p1-26.u15.fos23.x86_64.rpm openssh-askpass-8.8p1-26.u15.fos23.x86_64.rpm pam_ssh_agent_auth-0.10.4-4.26.u15.fos23.x86_64.rpm openssh-help-8.8p1-26.u15.fos23.noarch.rpm openssh-8.8p1-26.u15.fos23.aarch64.rpm openssh-clients-8.8p1-26.u15.fos23.aarch64.rpm openssh-server-8.8p1-26.u15.fos23.aarch64.rpm openssh-keycat-8.8p1-26.u15.fos23.aarch64.rpm openssh-askpass-8.8p1-26.u15.fos23.aarch64.rpm pam_ssh_agent_auth-0.10.4-4.26.u15.fos23.aarch64.rpm FusionOS-SA-2024-2035 Moderate FusionOS CVE-2024-0727:Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue. OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass(). We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. FusionOS openssl-1.1.1m-32.u14.fos23.x86_64.rpm openssl-libs-1.1.1m-32.u14.fos23.x86_64.rpm openssl-perl-1.1.1m-32.u14.fos23.x86_64.rpm openssl-devel-1.1.1m-32.u14.fos23.x86_64.rpm openssl-help-1.1.1m-32.u14.fos23.noarch.rpm openssl-1.1.1m-32.u14.fos23.aarch64.rpm openssl-libs-1.1.1m-32.u14.fos23.aarch64.rpm openssl-perl-1.1.1m-32.u14.fos23.aarch64.rpm openssl-devel-1.1.1m-32.u14.fos23.aarch64.rpm FusionOS-SA-2024-2036 Moderate FusionOS CVE-2024-22365:linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY. FusionOS pam-1.5.2-7.u4.fos23.x86_64.rpm pam-devel-1.5.2-7.u4.fos23.x86_64.rpm pam-help-1.5.2-7.u4.fos23.noarch.rpm pam-1.5.2-7.u4.fos23.aarch64.rpm pam-devel-1.5.2-7.u4.fos23.aarch64.rpm FusionOS-SA-2024-2037 Important FusionOS CVE-2023-51713:make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandling of quote/backslash semantics. CVE-2023-48795:The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust. FusionOS proftpd-1.3.8b-1.fos23.x86_64.rpm proftpd-devel-1.3.8b-1.fos23.x86_64.rpm proftpd-ldap-1.3.8b-1.fos23.x86_64.rpm proftpd-mysql-1.3.8b-1.fos23.x86_64.rpm proftpd-postgresql-1.3.8b-1.fos23.x86_64.rpm proftpd-sqlite-1.3.8b-1.fos23.x86_64.rpm proftpd-utils-1.3.8b-1.fos23.x86_64.rpm proftpd-1.3.8b-1.fos23.aarch64.rpm proftpd-devel-1.3.8b-1.fos23.aarch64.rpm proftpd-ldap-1.3.8b-1.fos23.aarch64.rpm proftpd-mysql-1.3.8b-1.fos23.aarch64.rpm proftpd-postgresql-1.3.8b-1.fos23.aarch64.rpm proftpd-sqlite-1.3.8b-1.fos23.aarch64.rpm proftpd-utils-1.3.8b-1.fos23.aarch64.rpm FusionOS-SA-2024-2038 Moderate FusionOS CVE-2024-22195:Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based. FusionOS python3-jinja2-3.0.3-3.u1.fos23.noarch.rpm python-jinja2-help-3.0.3-3.u1.fos23.noarch.rpm FusionOS-SA-2024-2039 Low FusionOS CVE-2022-3102:The JWT code can auto-detect the type of token being provided, and this can lead the application to incorrect conclusions about the trustworthiness of the token. Quoting the private disclosure we received : "Under certain circumstances, it is possible to substitute a [..] signed JWS with a JWE that is encrypted with the public key that is normally used for signature validation." This substitution attack can occur only if the validating application also have access to the private key, normally used to sign the tokens, available during validation of the received JWT. The significance of this attacks depends on the use of the token, it may lead to authentication bypass or authorization bypass (respectively if claims are used to authenticate or authorize certain actions), because the attacker has full control of the data placed in the JWE and can inject any desired claim value. FusionOS python3-jwcrypto-1.4.2-1.fos23.noarch.rpm FusionOS-SA-2024-2040 Important FusionOS CVE-2022-45198:Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). CVE-2023-50447:Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter). FusionOS python3-pillow-9.0.1-6.u3.fos23.x86_64.rpm python3-pillow-devel-9.0.1-6.u3.fos23.x86_64.rpm python3-pillow-help-9.0.1-6.u3.fos23.noarch.rpm python3-pillow-tk-9.0.1-6.u3.fos23.x86_64.rpm python3-pillow-qt-9.0.1-6.u3.fos23.x86_64.rpm python3-pillow-9.0.1-6.u3.fos23.aarch64.rpm python3-pillow-devel-9.0.1-6.u3.fos23.aarch64.rpm python3-pillow-tk-9.0.1-6.u3.fos23.aarch64.rpm python3-pillow-qt-9.0.1-6.u3.fos23.aarch64.rpm FusionOS-SA-2024-2041 Moderate FusionOS CVE-2023-52323:PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack. FusionOS python3-pycryptodome-3.19.1-1.fos23.x86_64.rpm python3-pycryptodome-3.19.1-1.fos23.aarch64.rpm FusionOS-SA-2024-2042 Moderate FusionOS CVE-2023-52323:PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack. FusionOS python3-pycryptodomex-3.19.1-1.fos23.x86_64.rpm python-pycryptodomex-help-3.19.1-1.fos23.noarch.rpm python3-pycryptodomex-3.19.1-1.fos23.aarch64.rpm FusionOS-SA-2024-2043 Critical FusionOS CVE-2023-51714:An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check. FusionOS qt5-qtbase-5.15.2-14.u7.fos23.x86_64.rpm qt5-qtbase-common-5.15.2-14.u7.fos23.noarch.rpm qt5-qtbase-devel-5.15.2-14.u7.fos23.x86_64.rpm qt5-qtbase-private-devel-5.15.2-14.u7.fos23.x86_64.rpm qt5-qtbase-examples-5.15.2-14.u7.fos23.x86_64.rpm qt5-qtbase-static-5.15.2-14.u7.fos23.x86_64.rpm qt5-qtbase-mysql-5.15.2-14.u7.fos23.x86_64.rpm qt5-qtbase-odbc-5.15.2-14.u7.fos23.x86_64.rpm qt5-qtbase-postgresql-5.15.2-14.u7.fos23.x86_64.rpm qt5-qtbase-gui-5.15.2-14.u7.fos23.x86_64.rpm qt5-qtbase-5.15.2-14.u7.fos23.aarch64.rpm qt5-qtbase-devel-5.15.2-14.u7.fos23.aarch64.rpm qt5-qtbase-private-devel-5.15.2-14.u7.fos23.aarch64.rpm qt5-qtbase-examples-5.15.2-14.u7.fos23.aarch64.rpm qt5-qtbase-static-5.15.2-14.u7.fos23.aarch64.rpm qt5-qtbase-mysql-5.15.2-14.u7.fos23.aarch64.rpm qt5-qtbase-odbc-5.15.2-14.u7.fos23.aarch64.rpm qt5-qtbase-postgresql-5.15.2-14.u7.fos23.aarch64.rpm qt5-qtbase-gui-5.15.2-14.u7.fos23.aarch64.rpm FusionOS-SA-2024-2044 Moderate FusionOS CVE-2024-23301:Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root. FusionOS rear-2.4-5.u1.fos23.x86_64.rpm rear-help-2.4-5.u1.fos23.noarch.rpm FusionOS-SA-2024-2045 Important FusionOS CVE-2023-22792:A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately. CVE-2023-22795:A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately. FusionOS rubygem-actionpack-6.1.4.1-4.u2.fos23.noarch.rpm rubygem-actionpack-doc-6.1.4.1-4.u2.fos23.noarch.rpm FusionOS-SA-2024-2046 Moderate FusionOS CVE-2022-23634:Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability. FusionOS rubygem-puma-5.5.2-2.u1.fos23.x86_64.rpm rubygem-puma-doc-5.5.2-2.u1.fos23.noarch.rpm rubygem-puma-5.5.2-2.u1.fos23.aarch64.rpm FusionOS-SA-2024-2047 Important FusionOS CVE-2023-40547:A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully. CVE-2023-40548:A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase. CVE-2023-40549:An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service. CVE-2023-40550:An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase. CVE-2023-40551:A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase. FusionOS shim-15.6-16.u10.fos23.x86_64.rpm shim-15.6-16.u10.fos23.aarch64.rpm FusionOS-SA-2024-2048 Critical FusionOS CVE-2021-33844:A floating point exception (divide-by-zero) issue was discovered in SoX in functon startread() of wav.c file. An attacker with a crafted wav file, could cause an application to crash. CVE-2023-32627:A floating point exception vulnerability was found in sox, in the read_samples function at sox/src/voc.c:334:18. This flaw can lead to a denial of service. CVE-2021-23159:A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function lsx_read_w_buf() in formats_i.c file. The vulnerability is exploitable with a crafted file, that could cause an application to crash. CVE-2023-34432:A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at sox/src/formats_i.c:98:16. This flaw can lead to a denial of service, code execution, or information disclosure. CVE-2023-34318:A heap buffer overflow vulnerability was found in sox, in the startread function at sox/src/hcom.c:160:41. This flaw can lead to a denial of service, code execution, or information disclosure. CVE-2021-23172:A vulnerability was found in SoX, where a heap-buffer-overflow occurs in function startread() in hcom.c file. The vulnerability is exploitable with a crafted hcomn file, that could cause an application to crash. CVE-2021-3643:A flaw was found in sox 14.4.1. The lsx_adpcm_init function within libsox leads to a global-buffer-overflow. This flaw allows an attacker to input a malicious file, leading to the disclosure of sensitive information. CVE-2021-23210:A floating point exception (divide-by-zero) issue was discovered in SoX in functon read_samples() of voc.c file. An attacker with a crafted file, could cause an application to crash. CVE-2022-31650:In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a. CVE-2023-26590:A floating point exception vulnerability was found in sox, in the lsx_aiffstartwrite function at sox/src/aiff.c:622:58. This flaw can lead to a denial of service. CVE-2022-31651:In SoX 14.4.2, there is an assertion failure in rate_init in rate.c in libsox.a. CVE-2023-32627:A floating point exception vulnerability was found in sox, in the read_samples function at sox/src/voc.c:334:18. This flaw can lead to a denial of service. CVE-2017-18189:In the startread function in xa.c in Sound eXchange (SoX) through 14.4.2, a corrupt header specifying zero channels triggers an infinite loop with a resultant NULL pointer dereference, which may allow a remote attacker to cause a denial-of-service. FusionOS sox-14.4.2.0-30.u1.fos23.x86_64.rpm sox-devel-14.4.2.0-30.u1.fos23.x86_64.rpm sox-help-14.4.2.0-30.u1.fos23.noarch.rpm sox-14.4.2.0-30.u1.fos23.aarch64.rpm sox-devel-14.4.2.0-30.u1.fos23.aarch64.rpm FusionOS-SA-2024-2049 Moderate FusionOS CVE-2024-23638:Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: `http_access deny manager`. FusionOS squid-4.9-23.u4.fos23.x86_64.rpm squid-4.9-23.u4.fos23.aarch64.rpm FusionOS-SA-2024-2050 Important FusionOS CVE-2023-24998:Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured. CVE-2023-28709:The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur. CVE-2023-42795:Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue. CVE-2024-21733:Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue. FusionOS tomcat-9.0.10-33.u13.fos23.noarch.rpm tomcat-jsvc-9.0.10-33.u13.fos23.noarch.rpm tomcat-help-9.0.10-33.u13.fos23.noarch.rpm FusionOS-SA-2024-2051 Important FusionOS CVE-2024-0208:GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file CVE-2024-0209:IEEE 1609.2 dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file FusionOS wireshark-3.6.14-6.u9.fos23.x86_64.rpm wireshark-devel-3.6.14-6.u9.fos23.x86_64.rpm wireshark-help-3.6.14-6.u9.fos23.x86_64.rpm wireshark-3.6.14-6.u9.fos23.aarch64.rpm wireshark-devel-3.6.14-6.u9.fos23.aarch64.rpm wireshark-help-3.6.14-6.u9.fos23.aarch64.rpm FusionOS-SA-2024-2052 Critical FusionOS CVE-2024-21885:A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can trigger a heap buffer overflow condition, which may lead to an application crash or remote code execution in SSH X11 forwarding environments. CVE-2024-21886:A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in some circumstances, remote code execution in SSH X11 forwarding environments. CVE-2024-0408:A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL. CVE-2024-0409:A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context. CVE-2023-6816:A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used. CVE-2024-0229:An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different master device. This issue may lead to an application crash, local privilege escalation (if the server runs with extended privileges), or remote code execution in SSH X11 forwarding environments. FusionOS xorg-x11-server-1.20.11-25.u12.fos23.x86_64.rpm xorg-x11-server-common-1.20.11-25.u12.fos23.x86_64.rpm xorg-x11-server-Xnest-1.20.11-25.u12.fos23.x86_64.rpm xorg-x11-server-Xdmx-1.20.11-25.u12.fos23.x86_64.rpm xorg-x11-server-Xvfb-1.20.11-25.u12.fos23.x86_64.rpm xorg-x11-server-Xephyr-1.20.11-25.u12.fos23.x86_64.rpm xorg-x11-server-devel-1.20.11-25.u12.fos23.x86_64.rpm xorg-x11-server-help-1.20.11-25.u12.fos23.noarch.rpm xorg-x11-server-source-1.20.11-25.u12.fos23.noarch.rpm xorg-x11-server-1.20.11-25.u12.fos23.aarch64.rpm xorg-x11-server-common-1.20.11-25.u12.fos23.aarch64.rpm xorg-x11-server-Xnest-1.20.11-25.u12.fos23.aarch64.rpm xorg-x11-server-Xdmx-1.20.11-25.u12.fos23.aarch64.rpm xorg-x11-server-Xvfb-1.20.11-25.u12.fos23.aarch64.rpm xorg-x11-server-Xephyr-1.20.11-25.u12.fos23.aarch64.rpm xorg-x11-server-devel-1.20.11-25.u12.fos23.aarch64.rpm FusionOS-SA-2024-2053 Moderate FusionOS CVE-2024-1062:A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr. FusionOS 389-ds-base-1.4.3.36-5.u2.fos23.x86_64.rpm 389-ds-base-legacy-tools-1.4.3.36-5.u2.fos23.x86_64.rpm 389-ds-base-devel-1.4.3.36-5.u2.fos23.x86_64.rpm 389-ds-base-snmp-1.4.3.36-5.u2.fos23.x86_64.rpm python3-lib389-1.4.3.36-5.u2.fos23.noarch.rpm cockpit-389-ds-1.4.3.36-5.u2.fos23.noarch.rpm 389-ds-base-help-1.4.3.36-5.u2.fos23.x86_64.rpm 389-ds-base-1.4.3.36-5.u2.fos23.aarch64.rpm 389-ds-base-legacy-tools-1.4.3.36-5.u2.fos23.aarch64.rpm 389-ds-base-devel-1.4.3.36-5.u2.fos23.aarch64.rpm 389-ds-base-snmp-1.4.3.36-5.u2.fos23.aarch64.rpm 389-ds-base-help-1.4.3.36-5.u2.fos23.aarch64.rpm FusionOS-SA-2024-2054 Critical FusionOS CVE-2023-5841:Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the affected library. FusionOS OpenEXR-3.1.5-2.u1.fos23.x86_64.rpm OpenEXR-libs-3.1.5-2.u1.fos23.x86_64.rpm OpenEXR-devel-3.1.5-2.u1.fos23.x86_64.rpm OpenEXR-3.1.5-2.u1.fos23.aarch64.rpm OpenEXR-libs-3.1.5-2.u1.fos23.aarch64.rpm OpenEXR-devel-3.1.5-2.u1.fos23.aarch64.rpm FusionOS-SA-2024-2055 Moderate FusionOS CVE-2024-21742:Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages. FusionOS apache-mime4j-0.8.3-2.u1.fos23.noarch.rpm apache-mime4j-javadoc-0.8.3-2.u1.fos23.noarch.rpm FusionOS-SA-2024-2056 Moderate FusionOS CVE-2023-48795:The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust. FusionOS apache-sshd-2.9.2-3.u2.fos23.noarch.rpm apache-sshd-javadoc-2.9.2-3.u2.fos23.noarch.rpm FusionOS-SA-2024-2057 Important FusionOS CVE-2024-24897:Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in openEuler A-Tune-Collector on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/A-Tune-Collector/blob/master/atune_collector/plugin/monitor/process/sched.Py. This issue affects A-Tune-Collector: from 1.1.0-3 through 1.3.0. FusionOS atune-collector-1.1.0-8.u7.fos23.x86_64.rpm atune-collector-1.1.0-8.u7.fos23.aarch64.rpm FusionOS-SA-2024-2058 Important FusionOS CVE-2023-25584:An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils. FusionOS binutils-2.37-24.u11.fos23.x86_64.rpm binutils-devel-2.37-24.u11.fos23.x86_64.rpm binutils-help-2.37-24.u11.fos23.x86_64.rpm binutils-2.37-24.u11.fos23.aarch64.rpm binutils-devel-2.37-24.u11.fos23.aarch64.rpm binutils-help-2.37-24.u11.fos23.aarch64.rpm FusionOS-SA-2024-2059 Moderate FusionOS CVE-2024-25629:c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist. FusionOS c-ares-1.18.1-8.u4.fos23.x86_64.rpm c-ares-devel-1.18.1-8.u4.fos23.x86_64.rpm c-ares-help-1.18.1-8.u4.fos23.noarch.rpm c-ares-1.18.1-8.u4.fos23.aarch64.rpm c-ares-devel-1.18.1-8.u4.fos23.aarch64.rpm FusionOS-SA-2024-2060 Critical FusionOS CVE-2022-46337:A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk by creating junk Derby databases. In LDAP-authenticated Derby installations, this could also allow the attacker to execute malware which was visible to and executable by the account which booted the Derby server. In LDAP-protected databases which weren't also protected by SQL GRANT/REVOKE authorization, this vulnerability could also let an attacker view and corrupt sensitive data and run sensitive database functions and procedures. Mitigation: Users should upgrade to Java 21 and Derby 10.17.1.0. Alternatively, users who wish to remain on older Java versions should build their own Derby distribution from one of the release families to which the fix was backported: 10.16, 10.15, and 10.14. Those are the releases which correspond, respectively, with Java LTS versions 17, 11, and 8. FusionOS derby-10.14.2.0-1.fos23.noarch.rpm derby-javadoc-10.14.2.0-1.fos23.noarch.rpm FusionOS-SA-2024-2061 Important FusionOS CVE-2022-2795:By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service. CVE-2022-38177:By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources. CVE-2022-38178:By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources. FusionOS dhcp-4.4.3-6.u4.fos23.x86_64.rpm dhcp-devel-4.4.3-6.u4.fos23.x86_64.rpm dhcp-help-4.4.3-6.u4.fos23.noarch.rpm dhcp-4.4.3-6.u4.fos23.aarch64.rpm dhcp-devel-4.4.3-6.u4.fos23.aarch64.rpm FusionOS-SA-2024-2062 Important FusionOS CVE-2022-36763:EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability. CVE-2022-36764:EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability. CVE-2022-36765:EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability. CVE-2023-45229:EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality. CVE-2023-45230:EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in DHCPv6 client. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability. CVE-2023-45231:EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing  Neighbor Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality. CVE-2023-45232:EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability. CVE-2023-45233:EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability. CVE-2023-45234:EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability. CVE-2023-45235:EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability. CVE-2023-0464:A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. CVE-2023-0465:Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. CVE-2023-0466:The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications. CVE-2023-2650:Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(n^2) with 'n' being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature. The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer's certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low. CVE-2023-3446:Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. CVE-2023-3817:Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. CVE-2024-0727:Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue. OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass(). We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. FusionOS edk2-devel-202011-16.u5.fos23.x86_64.rpm python3-edk2-devel-202011-16.u5.fos23.noarch.rpm edk2-help-202011-16.u5.fos23.noarch.rpm edk2-ovmf-202011-16.u5.fos23.noarch.rpm edk2-devel-202011-16.u5.fos23.aarch64.rpm FusionOS-SA-2024-2063 Moderate FusionOS CVE-2023-48795:The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust. FusionOS erlang-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-asn1-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-common_test-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-compiler-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-crypto-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-debugger-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-dialyzer-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-diameter-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-edoc-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-eldap-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-erl_docgen-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-erl_interface-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-erts-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-et-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-eunit-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-examples-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-ftp-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-hipe-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-inets-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-jinterface-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-kernel-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-megaco-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-mnesia-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-observer-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-odbc-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-os_mon-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-parsetools-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-public_key-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-reltool-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-runtime_tools-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-sasl-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-snmp-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-ssh-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-ssl-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-stdlib-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-syntax_tools-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-tftp-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-tools-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-wx-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-xmerl-23.3.4.9-4.u2.fos23.x86_64.rpm erlang-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-asn1-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-common_test-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-compiler-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-crypto-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-debugger-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-dialyzer-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-diameter-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-edoc-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-eldap-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-erl_docgen-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-erl_interface-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-erts-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-et-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-eunit-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-examples-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-ftp-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-hipe-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-inets-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-jinterface-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-kernel-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-megaco-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-mnesia-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-observer-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-odbc-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-os_mon-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-parsetools-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-public_key-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-reltool-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-runtime_tools-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-sasl-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-snmp-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-ssh-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-ssl-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-stdlib-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-syntax_tools-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-tftp-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-tools-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-wx-23.3.4.9-4.u2.fos23.aarch64.rpm erlang-xmerl-23.3.4.9-4.u2.fos23.aarch64.rpm FusionOS-SA-2024-2064 Important FusionOS CVE-2023-7104:A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999. CVE-2022-3479:A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash. FusionOS firefox-102.15.0-5.u5.fos23.x86_64.rpm firefox-102.15.0-5.u5.fos23.aarch64.rpm FusionOS-SA-2024-2065 Moderate FusionOS CVE-2024-25081:Splinefont in FontForge through 20230101 allows command injection via crafted filenames. CVE-2024-25082:Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files. FusionOS fontforge-20200314-8.u1.fos23.x86_64.rpm fontforge-devel-20200314-8.u1.fos23.x86_64.rpm fontforge-help-20200314-8.u1.fos23.noarch.rpm fontforge-20200314-8.u1.fos23.aarch64.rpm fontforge-devel-20200314-8.u1.fos23.aarch64.rpm FusionOS-SA-2024-2066 Important FusionOS CVE-2024-24258:freeglut 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddSubMenu function. CVE-2024-24259:freeglut through 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddMenuEntry function. FusionOS freeglut-3.0.0-12.u1.fos23.x86_64.rpm freeglut-devel-3.0.0-12.u1.fos23.x86_64.rpm freeglut-help-3.0.0-12.u1.fos23.x86_64.rpm freeglut-3.0.0-12.u1.fos23.aarch64.rpm freeglut-devel-3.0.0-12.u1.fos23.aarch64.rpm freeglut-help-3.0.0-12.u1.fos23.aarch64.rpm FusionOS-SA-2024-2067 Important FusionOS CVE-2023-46751:An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the application via a dangling pointer. FusionOS ghostscript-9.55.0-6.u5.fos23.x86_64.rpm ghostscript-devel-9.55.0-6.u5.fos23.x86_64.rpm ghostscript-help-9.55.0-6.u5.fos23.noarch.rpm ghostscript-tools-dvipdf-9.55.0-6.u5.fos23.x86_64.rpm ghostscript-9.55.0-6.u5.fos23.aarch64.rpm ghostscript-devel-9.55.0-6.u5.fos23.aarch64.rpm ghostscript-tools-dvipdf-9.55.0-6.u5.fos23.aarch64.rpm FusionOS-SA-2024-2068 Low FusionOS CVE-2020-36774:plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to a denial of service (application crash). FusionOS glade-3.36.0-3.u1.fos23.x86_64.rpm glade-libs-3.36.0-3.u1.fos23.x86_64.rpm glade-devel-3.36.0-3.u1.fos23.x86_64.rpm glade-help-3.36.0-3.u1.fos23.noarch.rpm glade-3.36.0-3.u1.fos23.aarch64.rpm glade-libs-3.36.0-3.u1.fos23.aarch64.rpm glade-devel-3.36.0-3.u1.fos23.aarch64.rpm FusionOS-SA-2024-2069 Important FusionOS CVE-2022-48340:In Gluster GlusterFS 11.0, there is an xlators/cluster/dht/src/dht-common.c dht_setxattr_mds_cbk use-after-free. FusionOS glusterfs-10.0-9.u2.fos23.x86_64.rpm glusterfs-cli-10.0-9.u2.fos23.x86_64.rpm glusterfs-cloudsync-plugins-10.0-9.u2.fos23.x86_64.rpm glusterfs-extra-xlators-10.0-9.u2.fos23.x86_64.rpm glusterfs-fuse-10.0-9.u2.fos23.x86_64.rpm glusterfs-geo-replication-10.0-9.u2.fos23.x86_64.rpm libglusterfs0-10.0-9.u2.fos23.x86_64.rpm libglusterfs-devel-10.0-9.u2.fos23.x86_64.rpm libgfapi0-10.0-9.u2.fos23.x86_64.rpm libgfapi-devel-10.0-9.u2.fos23.x86_64.rpm libgfchangelog0-10.0-9.u2.fos23.x86_64.rpm libgfchangelog-devel-10.0-9.u2.fos23.x86_64.rpm libgfrpc0-10.0-9.u2.fos23.x86_64.rpm libgfrpc-devel-10.0-9.u2.fos23.x86_64.rpm libgfxdr0-10.0-9.u2.fos23.x86_64.rpm libgfxdr-devel-10.0-9.u2.fos23.x86_64.rpm libglusterd0-10.0-9.u2.fos23.x86_64.rpm python3-gluster-10.0-9.u2.fos23.x86_64.rpm glusterfs-resource-agents-10.0-9.u2.fos23.noarch.rpm glusterfs-server-10.0-9.u2.fos23.x86_64.rpm glusterfs-thin-arbiter-10.0-9.u2.fos23.x86_64.rpm glusterfs-client-xlators-10.0-9.u2.fos23.x86_64.rpm glusterfs-events-10.0-9.u2.fos23.x86_64.rpm glusterfs-10.0-9.u2.fos23.aarch64.rpm glusterfs-cli-10.0-9.u2.fos23.aarch64.rpm glusterfs-cloudsync-plugins-10.0-9.u2.fos23.aarch64.rpm glusterfs-extra-xlators-10.0-9.u2.fos23.aarch64.rpm glusterfs-fuse-10.0-9.u2.fos23.aarch64.rpm glusterfs-geo-replication-10.0-9.u2.fos23.aarch64.rpm libglusterfs0-10.0-9.u2.fos23.aarch64.rpm libglusterfs-devel-10.0-9.u2.fos23.aarch64.rpm libgfapi0-10.0-9.u2.fos23.aarch64.rpm libgfapi-devel-10.0-9.u2.fos23.aarch64.rpm libgfchangelog0-10.0-9.u2.fos23.aarch64.rpm libgfchangelog-devel-10.0-9.u2.fos23.aarch64.rpm libgfrpc0-10.0-9.u2.fos23.aarch64.rpm libgfrpc-devel-10.0-9.u2.fos23.aarch64.rpm libgfxdr0-10.0-9.u2.fos23.aarch64.rpm libgfxdr-devel-10.0-9.u2.fos23.aarch64.rpm libglusterd0-10.0-9.u2.fos23.aarch64.rpm python3-gluster-10.0-9.u2.fos23.aarch64.rpm glusterfs-server-10.0-9.u2.fos23.aarch64.rpm glusterfs-thin-arbiter-10.0-9.u2.fos23.aarch64.rpm glusterfs-client-xlators-10.0-9.u2.fos23.aarch64.rpm glusterfs-events-10.0-9.u2.fos23.aarch64.rpm FusionOS-SA-2024-2070 Important FusionOS CVE-2023-39326:A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small. CVE-2023-45285:Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off). FusionOS golang-1.20.5-3.u8.fos23.x86_64.rpm golang-help-1.20.5-3.u8.fos23.noarch.rpm golang-devel-1.20.5-3.u8.fos23.noarch.rpm golang-1.20.5-3.u8.fos23.aarch64.rpm FusionOS-SA-2024-2071 Low FusionOS CVE-2024-1048:A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv file. If the program is killed before the rename operation, the temporary file will not be removed and may fill the filesystem when invoked multiple times, resulting in a filesystem out of free inodes or blocks. FusionOS grub2-common-2.06-41.u13.fos23.noarch.rpm grub2-tools-2.06-41.u13.fos23.x86_64.rpm grub2-tools-minimal-2.06-41.u13.fos23.x86_64.rpm grub2-tools-extra-2.06-41.u13.fos23.x86_64.rpm grub2-tools-efi-2.06-41.u13.fos23.x86_64.rpm grub2-efi-x64-2.06-41.u13.fos23.x86_64.rpm grub2-efi-x64-modules-2.06-41.u13.fos23.noarch.rpm grub2-efi-x64-cdboot-2.06-41.u13.fos23.x86_64.rpm grub2-efi-ia32-2.06-41.u13.fos23.x86_64.rpm grub2-efi-ia32-modules-2.06-41.u13.fos23.noarch.rpm grub2-efi-ia32-cdboot-2.06-41.u13.fos23.x86_64.rpm grub2-pc-2.06-41.u13.fos23.x86_64.rpm grub2-pc-modules-2.06-41.u13.fos23.noarch.rpm grub2-help-2.06-41.u13.fos23.noarch.rpm grub2-tools-2.06-41.u13.fos23.aarch64.rpm grub2-tools-minimal-2.06-41.u13.fos23.aarch64.rpm grub2-tools-extra-2.06-41.u13.fos23.aarch64.rpm FusionOS-SA-2024-2072 Moderate FusionOS CVE-2023-37327:A heap-based buffer overflow vulnerability was found in the FLAC parser in GStreamer. This issue occurs when processing malformed image tags, which could allow a malicious third party to induce a crash in the application and potentially execute code by manipulating the heap. FusionOS gstreamer1-plugins-good-1.16.2-6.u2.fos23.x86_64.rpm gstreamer1-plugins-good-gtk-1.16.2-6.u2.fos23.x86_64.rpm gstreamer1-plugins-good-help-1.16.2-6.u2.fos23.noarch.rpm gstreamer1-plugins-good-1.16.2-6.u2.fos23.aarch64.rpm gstreamer1-plugins-good-gtk-1.16.2-6.u2.fos23.aarch64.rpm FusionOS-SA-2024-2073 Moderate FusionOS CVE-2018-17433:A heap-based buffer overflow in ReadGifImageDesc() in gifread.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while converting a GIF file to an HDF file. CVE-2018-17436:ReadCode() in decompress.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service (invalid write access) via a crafted HDF5 file. This issue was triggered while converting a GIF file to an HDF file. CVE-2020-10809:An issue was discovered in HDF5 through 1.12.0. A heap-based buffer overflow exists in the function Decompress() located in decompress.c. It can be triggered by sending a crafted file to the gif2h5 binary. It allows an attacker to cause Denial of Service. FusionOS hdf5-1.12.1-6.u4.fos23.x86_64.rpm hdf5-devel-1.12.1-6.u4.fos23.x86_64.rpm hdf5-mpich-1.12.1-6.u4.fos23.x86_64.rpm hdf5-mpich-devel-1.12.1-6.u4.fos23.x86_64.rpm hdf5-mpich-static-1.12.1-6.u4.fos23.x86_64.rpm hdf5-openmpi-1.12.1-6.u4.fos23.x86_64.rpm hdf5-openmpi-devel-1.12.1-6.u4.fos23.x86_64.rpm hdf5-openmpi-static-1.12.1-6.u4.fos23.x86_64.rpm hdf5-1.12.1-6.u4.fos23.aarch64.rpm hdf5-devel-1.12.1-6.u4.fos23.aarch64.rpm hdf5-mpich-1.12.1-6.u4.fos23.aarch64.rpm hdf5-mpich-devel-1.12.1-6.u4.fos23.aarch64.rpm hdf5-mpich-static-1.12.1-6.u4.fos23.aarch64.rpm hdf5-openmpi-1.12.1-6.u4.fos23.aarch64.rpm hdf5-openmpi-devel-1.12.1-6.u4.fos23.aarch64.rpm hdf5-openmpi-static-1.12.1-6.u4.fos23.aarch64.rpm FusionOS-SA-2024-2074 Important FusionOS CVE-2020-36518:jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. CVE-2022-42003:In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. CVE-2022-42004:In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization. FusionOS jackson-databind-2.9.8-10.u5.fos23.noarch.rpm jackson-databind-javadoc-2.9.8-10.u5.fos23.noarch.rpm FusionOS-SA-2024-2075 Important FusionOS CVE-2024-20918:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). CVE-2024-20919:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). CVE-2024-20952:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). CVE-2024-20945:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). CVE-2024-20921:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). CVE-2024-20926:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21; Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). FusionOS java-11-openjdk-11.0.22.7-0.fos23.x86_64.rpm java-11-openjdk-slowdebug-11.0.22.7-0.fos23.x86_64.rpm java-11-openjdk-headless-11.0.22.7-0.fos23.x86_64.rpm java-11-openjdk-headless-slowdebug-11.0.22.7-0.fos23.x86_64.rpm java-11-openjdk-devel-11.0.22.7-0.fos23.x86_64.rpm java-11-openjdk-devel-slowdebug-11.0.22.7-0.fos23.x86_64.rpm java-11-openjdk-jmods-11.0.22.7-0.fos23.x86_64.rpm java-11-openjdk-jmods-slowdebug-11.0.22.7-0.fos23.x86_64.rpm java-11-openjdk-demo-11.0.22.7-0.fos23.x86_64.rpm java-11-openjdk-demo-slowdebug-11.0.22.7-0.fos23.x86_64.rpm java-11-openjdk-src-11.0.22.7-0.fos23.x86_64.rpm java-11-openjdk-src-slowdebug-11.0.22.7-0.fos23.x86_64.rpm java-11-openjdk-javadoc-11.0.22.7-0.fos23.x86_64.rpm java-11-openjdk-javadoc-zip-11.0.22.7-0.fos23.x86_64.rpm java-11-openjdk-11.0.22.7-0.fos23.aarch64.rpm java-11-openjdk-slowdebug-11.0.22.7-0.fos23.aarch64.rpm java-11-openjdk-headless-11.0.22.7-0.fos23.aarch64.rpm java-11-openjdk-headless-slowdebug-11.0.22.7-0.fos23.aarch64.rpm java-11-openjdk-devel-11.0.22.7-0.fos23.aarch64.rpm java-11-openjdk-devel-slowdebug-11.0.22.7-0.fos23.aarch64.rpm java-11-openjdk-jmods-11.0.22.7-0.fos23.aarch64.rpm java-11-openjdk-jmods-slowdebug-11.0.22.7-0.fos23.aarch64.rpm java-11-openjdk-demo-11.0.22.7-0.fos23.aarch64.rpm java-11-openjdk-demo-slowdebug-11.0.22.7-0.fos23.aarch64.rpm java-11-openjdk-src-11.0.22.7-0.fos23.aarch64.rpm java-11-openjdk-src-slowdebug-11.0.22.7-0.fos23.aarch64.rpm java-11-openjdk-javadoc-11.0.22.7-0.fos23.aarch64.rpm java-11-openjdk-javadoc-zip-11.0.22.7-0.fos23.aarch64.rpm FusionOS-SA-2024-2076 Moderate FusionOS CVE-2021-28168:Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users. FusionOS jersey-2.29.1-2.u2.fos23.noarch.rpm jersey-test-framework-2.29.1-2.u2.fos23.noarch.rpm jersey-javadoc-2.29.1-2.u2.fos23.noarch.rpm FusionOS-SA-2024-2077 Moderate FusionOS CVE-2023-28756:A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2. FusionOS jruby-1.7.22-4.u3.fos23.noarch.rpm jruby-devel-1.7.22-4.u3.fos23.noarch.rpm jruby-javadoc-1.7.22-4.u3.fos23.noarch.rpm FusionOS-SA-2024-2078 Moderate FusionOS CVE-2023-51074:json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method. FusionOS json-path-2.1.0-2.u1.fos23.noarch.rpm json-path-javadoc-2.1.0-2.u1.fos23.noarch.rpm FusionOS-SA-2024-2079 Moderate FusionOS CVE-2022-36033:jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expressions, which could allow XSS attacks when a reader subsequently clicks that link. If the non-default `SafeList.preserveRelativeLinks` option is enabled, HTML including `javascript:` URLs that have been crafted with control characters will not be sanitized. If the site that this HTML is published on does not set a Content Security Policy, an XSS attack is then possible. This issue is patched in jsoup 1.15.3. Users should upgrade to this version. Additionally, as the unsanitized input may have been persisted, old content should be cleaned again using the updated version. To remediate this issue without immediately upgrading: - disable `SafeList.preserveRelativeLinks`, which will rewrite input URLs as absolute URLs - ensure an appropriate [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) is defined. (This should be used regardless of upgrading, as a defence-in-depth best practice.) FusionOS jsoup-1.14.2-2.u1.fos23.noarch.rpm FusionOS-SA-2024-2080 Important FusionOS CVE-2024-23850:In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and crash because a subvolume can be read out too soon after its root item is inserted upon subvolume creation. CVE-2023-7042:A null pointer dereference vulnerability was found in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() in drivers/net/wireless/ath/ath10k/wmi-tlv.c in the Linux kernel. This issue could be exploited to trigger a denial of service. CVE-2023-52560:In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() When CONFIG_DAMON_VADDR_KUNIT_TEST=y and making CONFIG_DEBUG_KMEMLEAK=y and CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN=y, the below memory leak is detected. Since commit 9f86d624292c ("mm/damon/vaddr-test: remove unnecessary variables"), the damon_destroy_ctx() is removed, but still call damon_new_target() and damon_new_region(), the damon_region which is allocated by kmem_cache_alloc() in damon_new_region() and the damon_target which is allocated by kmalloc in damon_new_target() are not freed. And the damon_region which is allocated in damon_new_region() in damon_set_regions() is also not freed. So use damon_destroy_target to free all the damon_regions and damon_target. unreferenced object 0xffff888107c9a940 (size 64): comm "kunit_try_catch", pid 1069, jiffies 4294670592 (age 732.761s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 06 00 00 00 6b 6b 6b 6b ............kkkk 60 c7 9c 07 81 88 ff ff f8 cb 9c 07 81 88 ff ff `............... backtrace: [<ffffffff817e0167>] kmalloc_trace+0x27/0xa0 [<ffffffff819c11cf>] damon_new_target+0x3f/0x1b0 [<ffffffff819c7d55>] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0 [<ffffffff819c82be>] damon_test_apply_three_regions1+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff8881079cc740 (size 56): comm "kunit_try_catch", pid 1069, jiffies 4294670592 (age 732.761s) hex dump (first 32 bytes): 05 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 ................ 6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk backtrace: [<ffffffff819bc492>] damon_new_region+0x22/0x1c0 [<ffffffff819c7d91>] damon_do_test_apply_three_regions.constprop.0+0xd1/0x3e0 [<ffffffff819c82be>] damon_test_apply_three_regions1+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff888107c9ac40 (size 64): comm "kunit_try_catch", pid 1071, jiffies 4294670595 (age 732.843s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 06 00 00 00 6b 6b 6b 6b ............kkkk a0 cc 9c 07 81 88 ff ff 78 a1 76 07 81 88 ff ff ........x.v..... backtrace: [<ffffffff817e0167>] kmalloc_trace+0x27/0xa0 [<ffffffff819c11cf>] damon_new_target+0x3f/0x1b0 [<ffffffff819c7d55>] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0 [<ffffffff819c851e>] damon_test_apply_three_regions2+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20 unreferenced object 0xffff8881079ccc80 (size 56): comm "kunit_try_catch", pid 1071, jiffies 4294670595 (age 732.843s) hex dump (first 32 bytes): 05 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 ................ 6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b kkkkkkkk....kkkk backtrace: [<ffffffff819bc492>] damon_new_region+0x22/0x1c0 [<ffffffff819c7d91>] damon_do_test_apply_three_regions.constprop.0+0xd1/0x3e0 [<ffffffff819c851e>] damon_test_apply_three_regions2+0x21e/0x260 [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90 [<ffffffff81237cf6>] kthread+0x2b6/0x380 [<ffffffff81097add>] ret_from_fork+0x2d/0x70 [<ffff ---truncated--- CVE-2023-6531:A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on. CVE-2024-0607:A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval() function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes are written, but `dst` is an array of u32, so each element only has space for 4 bytes. That means every iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local user to cause a denial of service or potentially break NetFilter functionality. CVE-2023-6040:An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an attacker to achieve out-of-bounds access. CVE-2024-0641:A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux kernel’s TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system. CVE-2024-0565:An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service. CVE-2024-0340:A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file. CVE-2024-22705:An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2_get_data_area_len in fs/smb/server/smb2misc.c can cause an smb_strndup_from_utf16 out-of-bounds access because the relationship between Name data and CreateContexts data is mishandled. CVE-2023-46343:In the Linux kernel before 6.5.9, there is a NULL pointer dereference in send_acknowledge in net/nfc/nci/spi.c. CVE-2023-51042:In the Linux kernel before 6.4.12, amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c has a fence use-after-free. CVE-2023-6915:A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return. CVE-2023-51043:In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race condition between a nonblocking atomic commit and a driver unload. CVE-2023-52340:A flaw in the routing table size was found in the ICMPv6 handling of "Packet Too Big". The size of the routing table is regulated by periodic garbage collection. However, with "Packet Too Big Messages" it is possible to exceed the routing table size and garbage collector threshold. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95%. CVE-2024-23849:In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, resulting in out-of-bounds access. CVE-2023-46838:Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides a certain initial portion of the to be transferred data, these parts are directly translated into what Linux calls SKB fragments. Such converted request parts can, when for a particular SKB they are all of length zero, lead to a de-reference of NULL in core networking code. CVE-2024-0639:A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system. CVE-2024-1086:A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660. CVE-2024-0841:A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or potentially escalate their privileges on the system. CVE-2023-52435:In the Linux kernel, the following vulnerability has been resolved: net: prevent mss overflow in skb_segment() Once again syzbot is able to crash the kernel in skb_segment() [1] GSO_BY_FRAGS is a forbidden value, but unfortunately the following computation in skb_segment() can reach it quite easily : mss = mss * partial_segs; 65535 = 3 * 5 * 17 * 257, so many initial values of mss can lead to a bad final result. Make sure to limit segmentation so that the new mss value is smaller than GSO_BY_FRAGS. [1] general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 1 PID: 5079 Comm: syz-executor993 Not tainted 6.7.0-rc4-syzkaller-00141-g1ae4cd3cbdd0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:skb_segment+0x181d/0x3f30 net/core/skbuff.c:4551 Code: 83 e3 02 e9 fb ed ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84 24 f8 00 RSP: 0018:ffffc900043473d0 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000010046 RCX: ffffffff886b1597 RDX: 000000000000000e RSI: ffffffff886b2520 RDI: 0000000000000070 RBP: ffffc90004347578 R08: 0000000000000005 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000002 R12: ffff888063202ac0 R13: 0000000000010000 R14: 000000000000ffff R15: 0000000000000046 FS: 0000555556e7e380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020010000 CR3: 0000000027ee2000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> udp6_ufo_fragment+0xa0e/0xd00 net/ipv6/udp_offload.c:109 ipv6_gso_segment+0x534/0x17e0 net/ipv6/ip6_offload.c:120 skb_mac_gso_segment+0x290/0x610 net/core/gso.c:53 __skb_gso_segment+0x339/0x710 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x36c/0xeb0 net/core/dev.c:3626 __dev_queue_xmit+0x6f3/0x3d60 net/core/dev.c:4338 dev_queue_xmit include/linux/netdevice.h:3134 [inline] packet_xmit+0x257/0x380 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24c6/0x5220 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 __sys_sendto+0x255/0x340 net/socket.c:2190 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7f8692032aa9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff8d685418 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f8692032aa9 RDX: 0000000000010048 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 00000000000f4240 R08: 0000000020000540 R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff8d685480 R13: 0000000000000001 R14: 00007fff8d685480 R15: 0000000000000003 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:skb_segment+0x181d/0x3f30 net/core/skbuff.c:4551 Code: 83 e3 02 e9 fb ed ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84 24 f8 00 RSP: 0018:ffffc900043473d0 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000010046 RCX: ffffffff886b1597 RDX: 000000000000000e RSI: ffffffff886b2520 RDI: 0000000000000070 RBP: ffffc90004347578 R0 ---truncated--- CVE-2024-23196:A race condition was found in the Linux kernel's sound/hda device driver in snd_hdac_regmap_sync() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue. CVE-2023-50431:sec_attest_info in drivers/accel/habanalabs/common/habanalabs_ioctl.c in the Linux kernel through 6.6.5 allows an information leak to user space because info->pad0 is not initialized. CVE-2023-6560:An out-of-bounds memory access flaw was found in the io_uring SQ/CQ rings functionality in the Linux kernel. This issue could allow a local user to crash the system. CVE-2023-6622:A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service. FusionOS kernel-5.10.0-136.65.0.145.u108.fos23.x86_64.rpm kernel-headers-5.10.0-136.65.0.145.u108.fos23.x86_64.rpm kernel-devel-5.10.0-136.65.0.145.u108.fos23.x86_64.rpm kernel-tools-5.10.0-136.65.0.145.u108.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.65.0.145.u108.fos23.x86_64.rpm perf-5.10.0-136.65.0.145.u108.fos23.x86_64.rpm python3-perf-5.10.0-136.65.0.145.u108.fos23.x86_64.rpm bpftool-5.10.0-136.65.0.145.u108.fos23.x86_64.rpm kernel-5.10.0-136.65.0.145.u108.fos23.aarch64.rpm kernel-headers-5.10.0-136.65.0.145.u108.fos23.aarch64.rpm kernel-devel-5.10.0-136.65.0.145.u108.fos23.aarch64.rpm kernel-tools-5.10.0-136.65.0.145.u108.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.65.0.145.u108.fos23.aarch64.rpm perf-5.10.0-136.65.0.145.u108.fos23.aarch64.rpm python3-perf-5.10.0-136.65.0.145.u108.fos23.aarch64.rpm bpftool-5.10.0-136.65.0.145.u108.fos23.aarch64.rpm FusionOS-SA-2024-2081 Important FusionOS CVE-2022-48624:close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. FusionOS less-590-5.u2.fos23.x86_64.rpm less-help-590-5.u2.fos23.noarch.rpm less-590-5.u2.fos23.aarch64.rpm FusionOS-SA-2024-2082 Critical FusionOS CVE-2020-0452:In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution if a third party app used this library to process remote image data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID: A-159625731 FusionOS libexif-0.6.22-5.u3.fos23.x86_64.rpm libexif-devel-0.6.22-5.u3.fos23.x86_64.rpm libexif-help-0.6.22-5.u3.fos23.noarch.rpm libexif-0.6.22-5.u3.fos23.aarch64.rpm libexif-devel-0.6.22-5.u3.fos23.aarch64.rpm FusionOS-SA-2024-2083 Moderate FusionOS CVE-2023-48795:The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust. FusionOS libssh-0.9.6-9.u4.fos23.x86_64.rpm libssh-devel-0.9.6-9.u4.fos23.x86_64.rpm libssh-help-0.9.6-9.u4.fos23.noarch.rpm libssh-0.9.6-9.u4.fos23.aarch64.rpm libssh-devel-0.9.6-9.u4.fos23.aarch64.rpm FusionOS-SA-2024-2084 Moderate FusionOS CVE-2023-48795:The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust. FusionOS libssh2-1.10.0-5.u3.fos23.x86_64.rpm libssh2-devel-1.10.0-5.u3.fos23.x86_64.rpm libssh2-help-1.10.0-5.u3.fos23.noarch.rpm libssh2-1.10.0-5.u3.fos23.aarch64.rpm libssh2-devel-1.10.0-5.u3.fos23.aarch64.rpm FusionOS-SA-2024-2085 Important FusionOS CVE-2024-24806:libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. FusionOS libuv-1.42.0-8.u2.fos23.x86_64.rpm libuv-devel-1.42.0-8.u2.fos23.x86_64.rpm libuv-help-1.42.0-8.u2.fos23.noarch.rpm libuv-1.42.0-8.u2.fos23.aarch64.rpm libuv-devel-1.42.0-8.u2.fos23.aarch64.rpm FusionOS-SA-2024-2086 Important FusionOS CVE-2022-4450:The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue. CVE-2023-0215:The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7. Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream. The OpenSSL cms and smime command line applications are similarly affected. CVE-2023-0286:There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. CVE-2023-0464:A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. CVE-2023-0465:Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. CVE-2023-0466:The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications. CVE-2023-2650:Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(n^2) with 'n' being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature. The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer's certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low. CVE-2023-3446:Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. CVE-2023-3817:Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. CVE-2023-5678:Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. While DH_check() performs all the necessary checks (as of CVE-2023-3817), DH_check_pub_key() doesn't make any of these checks, and is therefore vulnerable for excessively large P and Q parameters. Likewise, while DH_generate_key() performs a check for an excessively large P, it doesn't check for an excessively large Q. An application that calls DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. DH_generate_key() and DH_check_pub_key() are also called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate(). Also vulnerable are the OpenSSL pkey command line application when using the "-pubcheck" option, as well as the OpenSSL genpkey command line application. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. CVE-2022-4304:A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. FusionOS sgxsdk-2.15.1-11.u2.fos23.x86_64.rpm libsgx-ae-qe3-2.15.1-11.u2.fos23.x86_64.rpm libsgx-pce-logic-2.15.1-11.u2.fos23.x86_64.rpm libsgx-qe3-logic-2.15.1-11.u2.fos23.x86_64.rpm sgx-aesm-service-2.15.1-11.u2.fos23.x86_64.rpm libsgx-ae-epid-2.15.1-11.u2.fos23.x86_64.rpm libsgx-ae-le-2.15.1-11.u2.fos23.x86_64.rpm libsgx-ae-pce-2.15.1-11.u2.fos23.x86_64.rpm libsgx-aesm-ecdsa-plugin-2.15.1-11.u2.fos23.x86_64.rpm libsgx-aesm-epid-plugin-2.15.1-11.u2.fos23.x86_64.rpm libsgx-aesm-launch-plugin-2.15.1-11.u2.fos23.x86_64.rpm libsgx-aesm-pce-plugin-2.15.1-11.u2.fos23.x86_64.rpm libsgx-aesm-quote-ex-plugin-2.15.1-11.u2.fos23.x86_64.rpm libsgx-epid-2.15.1-11.u2.fos23.x86_64.rpm libsgx-epid-devel-2.15.1-11.u2.fos23.x86_64.rpm libsgx-launch-2.15.1-11.u2.fos23.x86_64.rpm libsgx-launch-devel-2.15.1-11.u2.fos23.x86_64.rpm libsgx-quote-ex-2.15.1-11.u2.fos23.x86_64.rpm libsgx-quote-ex-devel-2.15.1-11.u2.fos23.x86_64.rpm libsgx-uae-service-2.15.1-11.u2.fos23.x86_64.rpm libsgx-enclave-common-2.15.1-11.u2.fos23.x86_64.rpm libsgx-enclave-common-devel-2.15.1-11.u2.fos23.x86_64.rpm libsgx-urts-2.15.1-11.u2.fos23.x86_64.rpm libsgx-dcap-default-qpl-2.15.1-11.u2.fos23.x86_64.rpm libsgx-dcap-default-qpl-devel-2.15.1-11.u2.fos23.x86_64.rpm sgx-dcap-pccs-2.15.1-11.u2.fos23.x86_64.rpm libsgx-dcap-ql-2.15.1-11.u2.fos23.x86_64.rpm libsgx-dcap-ql-devel-2.15.1-11.u2.fos23.x86_64.rpm libsgx-ae-qve-2.15.1-11.u2.fos23.x86_64.rpm libsgx-dcap-quote-verify-2.15.1-11.u2.fos23.x86_64.rpm libsgx-dcap-quote-verify-devel-2.15.1-11.u2.fos23.x86_64.rpm sgx-pck-id-retrieval-tool-2.15.1-11.u2.fos23.x86_64.rpm libsgx-ra-uefi-2.15.1-11.u2.fos23.x86_64.rpm libsgx-ra-uefi-devel-2.15.1-11.u2.fos23.x86_64.rpm libsgx-ra-network-2.15.1-11.u2.fos23.x86_64.rpm libsgx-ra-network-devel-2.15.1-11.u2.fos23.x86_64.rpm sgx-ra-service-2.15.1-11.u2.fos23.x86_64.rpm libsgx-headers-2.15.1-11.u2.fos23.x86_64.rpm FusionOS-SA-2024-2087 Important FusionOS CVE-2024-24814:mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability. FusionOS mod_auth_openidc-2.4.15.3-1.fos23.x86_64.rpm mod_auth_openidc-2.4.15.3-1.fos23.aarch64.rpm FusionOS-SA-2024-2088 Important FusionOS CVE-2023-0437:When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0. FusionOS mongo-c-driver-1.13.1-7.u1.fos23.x86_64.rpm mongo-c-driver-devel-1.13.1-7.u1.fos23.x86_64.rpm libbson-1.13.1-7.u1.fos23.x86_64.rpm libbson-devel-1.13.1-7.u1.fos23.x86_64.rpm mongo-c-driver-help-1.13.1-7.u1.fos23.x86_64.rpm mongo-c-driver-1.13.1-7.u1.fos23.aarch64.rpm mongo-c-driver-devel-1.13.1-7.u1.fos23.aarch64.rpm libbson-1.13.1-7.u1.fos23.aarch64.rpm libbson-devel-1.13.1-7.u1.fos23.aarch64.rpm mongo-c-driver-help-1.13.1-7.u1.fos23.aarch64.rpm FusionOS-SA-2024-2089 Moderate FusionOS CVE-2021-2471:Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H). CVE-2022-21363:Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). FusionOS mysql-connector-java-8.0.30-1.fos23.noarch.rpm FusionOS-SA-2024-2090 Important FusionOS CVE-2022-41881:Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder. CVE-2023-4586:A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack. FusionOS netty-4.1.13-21.u2.fos23.x86_64.rpm netty-help-4.1.13-21.u2.fos23.noarch.rpm netty-4.1.13-21.u2.fos23.aarch64.rpm FusionOS-SA-2024-2091 Important FusionOS CVE-2023-0464:A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. CVE-2023-0465:Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. CVE-2023-44487:The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. FusionOS nodejs-12.22.11-9.u4.fos23.x86_64.rpm nodejs-devel-12.22.11-9.u4.fos23.x86_64.rpm nodejs-libs-12.22.11-9.u4.fos23.x86_64.rpm nodejs-full-i18n-12.22.11-9.u4.fos23.x86_64.rpm v8-devel-7.8.279.23-1.12.22.11.9.u4.fos23.x86_64.rpm npm-6.14.16-1.12.22.11.9.u4.fos23.x86_64.rpm nodejs-docs-12.22.11-9.u4.fos23.noarch.rpm nodejs-12.22.11-9.u4.fos23.aarch64.rpm nodejs-devel-12.22.11-9.u4.fos23.aarch64.rpm nodejs-libs-12.22.11-9.u4.fos23.aarch64.rpm nodejs-full-i18n-12.22.11-9.u4.fos23.aarch64.rpm v8-devel-7.8.279.23-1.12.22.11.9.u4.fos23.aarch64.rpm npm-6.14.16-1.12.22.11.9.u4.fos23.aarch64.rpm FusionOS-SA-2024-2092 Moderate FusionOS CVE-2024-0727:Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue. OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass(). We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. FusionOS openresty-openssl111-asan-1.1.1h-2.u5.fos23.x86_64.rpm openresty-openssl111-asan-1.1.1h-2.u5.fos23.aarch64.rpm FusionOS-SA-2024-2093 Critical FusionOS CVE-2022-37434:zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference). FusionOS openresty-zlib-asan-1.2.11-14.fos23.x86_64.rpm openresty-zlib-asan-1.2.11-14.fos23.aarch64.rpm FusionOS-SA-2024-2094 Important FusionOS CVE-2023-3966:A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is enabled. FusionOS openvswitch-2.12.4-7.u5.fos23.x86_64.rpm openvswitch-devel-2.12.4-7.u5.fos23.x86_64.rpm openvswitch-help-2.12.4-7.u5.fos23.x86_64.rpm python3-openvswitch-2.12.4-7.u5.fos23.noarch.rpm openvswitch-2.12.4-7.u5.fos23.aarch64.rpm openvswitch-devel-2.12.4-7.u5.fos23.aarch64.rpm openvswitch-help-2.12.4-7.u5.fos23.aarch64.rpm FusionOS-SA-2024-2095 Critical FusionOS CVE-2023-47039:A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find and execute `cmd.exe` within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. This flaw allows an attacker with limited privileges to place`cmd.exe` in locations with weak permissions, such as `C:\ProgramData`. By doing so, arbitrary code can be executed when an administrator attempts to use this executable from these compromised locations. CVE-2023-47100:In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0. FusionOS perl-5.34.0-12.u5.fos23.x86_64.rpm perl-libs-5.34.0-12.u5.fos23.x86_64.rpm perl-devel-5.34.0-12.u5.fos23.x86_64.rpm perl-help-5.34.0-12.u5.fos23.noarch.rpm perl-5.34.0-12.u5.fos23.aarch64.rpm perl-libs-5.34.0-12.u5.fos23.aarch64.rpm perl-devel-5.34.0-12.u5.fos23.aarch64.rpm FusionOS-SA-2024-2096 Important FusionOS CVE-2023-39417:IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. FusionOS postgresql-13.12-1.u1.fos23.x86_64.rpm postgresql-private-libs-13.12-1.u1.fos23.x86_64.rpm postgresql-private-devel-13.12-1.u1.fos23.x86_64.rpm postgresql-server-13.12-1.u1.fos23.x86_64.rpm postgresql-docs-13.12-1.u1.fos23.x86_64.rpm postgresql-contrib-13.12-1.u1.fos23.x86_64.rpm postgresql-server-devel-13.12-1.u1.fos23.x86_64.rpm postgresql-test-rpm-macros-13.12-1.u1.fos23.noarch.rpm postgresql-static-13.12-1.u1.fos23.x86_64.rpm postgresql-plperl-13.12-1.u1.fos23.x86_64.rpm postgresql-plpython3-13.12-1.u1.fos23.x86_64.rpm postgresql-pltcl-13.12-1.u1.fos23.x86_64.rpm postgresql-test-13.12-1.u1.fos23.x86_64.rpm postgresql-llvmjit-13.12-1.u1.fos23.x86_64.rpm postgresql-13.12-1.u1.fos23.aarch64.rpm postgresql-private-libs-13.12-1.u1.fos23.aarch64.rpm postgresql-private-devel-13.12-1.u1.fos23.aarch64.rpm postgresql-server-13.12-1.u1.fos23.aarch64.rpm postgresql-docs-13.12-1.u1.fos23.aarch64.rpm postgresql-contrib-13.12-1.u1.fos23.aarch64.rpm postgresql-server-devel-13.12-1.u1.fos23.aarch64.rpm postgresql-static-13.12-1.u1.fos23.aarch64.rpm postgresql-plperl-13.12-1.u1.fos23.aarch64.rpm postgresql-plpython3-13.12-1.u1.fos23.aarch64.rpm postgresql-pltcl-13.12-1.u1.fos23.aarch64.rpm postgresql-test-13.12-1.u1.fos23.aarch64.rpm postgresql-llvmjit-13.12-1.u1.fos23.aarch64.rpm FusionOS-SA-2024-2097 Critical FusionOS CVE-2024-1597:pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected. FusionOS postgresql-jdbc-42.4.1-3.u2.fos23.noarch.rpm postgresql-jdbc-javadoc-42.4.1-3.u2.fos23.noarch.rpm postgresql-jdbc-help-42.4.1-3.u2.fos23.noarch.rpm FusionOS-SA-2024-2098 Moderate FusionOS CVE-2023-6681:A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can result in a large amount of computational consumption, causing a denial of service attack. FusionOS python3-jwcrypto-1.4.2-2.u1.fos23.noarch.rpm FusionOS-SA-2024-2099 Moderate FusionOS CVE-2023-48795:The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust. FusionOS python3-paramiko-2.11.0-3.u1.fos23.noarch.rpm python-paramiko-help-2.11.0-3.u1.fos23.noarch.rpm FusionOS-SA-2024-2100 Important FusionOS CVE-2023-5088:A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot. CVE-2023-0330:A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free. CVE-2023-3019:A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. CVE-2023-6693:A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables allocated on the stack. Specifically, the `out_sg` variable could be used to read a part of process memory and send it to the wire, causing an information leak. CVE-2023-6683:A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a malicious authenticated VNC client to crash QEMU and trigger a denial of service. CVE-2024-24474:QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len. FusionOS qemu-6.2.0-89.u15.fos23.x86_64.rpm qemu-guest-agent-6.2.0-89.u15.fos23.x86_64.rpm qemu-help-6.2.0-89.u15.fos23.noarch.rpm qemu-img-6.2.0-89.u15.fos23.x86_64.rpm qemu-block-rbd-6.2.0-89.u15.fos23.x86_64.rpm qemu-block-ssh-6.2.0-89.u15.fos23.x86_64.rpm qemu-block-iscsi-6.2.0-89.u15.fos23.x86_64.rpm qemu-block-curl-6.2.0-89.u15.fos23.x86_64.rpm qemu-hw-usb-host-6.2.0-89.u15.fos23.x86_64.rpm qemu-seabios-6.2.0-89.u15.fos23.x86_64.rpm qemu-system-aarch64-6.2.0-89.u15.fos23.x86_64.rpm qemu-system-arm-6.2.0-89.u15.fos23.x86_64.rpm qemu-system-x86_64-6.2.0-89.u15.fos23.x86_64.rpm qemu-system-riscv-6.2.0-89.u15.fos23.x86_64.rpm qemu-6.2.0-89.u15.fos23.aarch64.rpm qemu-guest-agent-6.2.0-89.u15.fos23.aarch64.rpm qemu-img-6.2.0-89.u15.fos23.aarch64.rpm qemu-block-rbd-6.2.0-89.u15.fos23.aarch64.rpm qemu-block-ssh-6.2.0-89.u15.fos23.aarch64.rpm qemu-block-iscsi-6.2.0-89.u15.fos23.aarch64.rpm qemu-block-curl-6.2.0-89.u15.fos23.aarch64.rpm qemu-hw-usb-host-6.2.0-89.u15.fos23.aarch64.rpm qemu-system-aarch64-6.2.0-89.u15.fos23.aarch64.rpm qemu-system-arm-6.2.0-89.u15.fos23.aarch64.rpm qemu-system-x86_64-6.2.0-89.u15.fos23.aarch64.rpm qemu-system-riscv-6.2.0-89.u15.fos23.aarch64.rpm FusionOS-SA-2024-2101 Moderate FusionOS CVE-2024-26144:Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7. FusionOS rubygem-activestorage-6.1.4.1-2.u1.fos23.noarch.rpm rubygem-activestorage-doc-6.1.4.1-2.u1.fos23.noarch.rpm FusionOS-SA-2024-2102 Moderate FusionOS CVE-2024-27285:YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36. FusionOS rubygem-yard-0.9.26-3.u1.fos23.noarch.rpm rubygem-yard-doc-0.9.26-3.u1.fos23.noarch.rpm FusionOS-SA-2024-2103 Important FusionOS CVE-2024-21626:runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue. FusionOS runc-1.1.3-24.u7.fos23.x86_64.rpm runc-1.1.3-24.u7.fos23.aarch64.rpm FusionOS-SA-2024-2104 Critical FusionOS CVE-2024-24577:libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_index_add` can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the `has_dir_name` function in `src/libgit2/index.c`, which frees an entry that should not be freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary code execution. This issue has been patched in version 1.6.5 and 1.7.2. FusionOS rust-1.60.0-3.u1.fos23.x86_64.rpm rust-std-static-1.60.0-3.u1.fos23.x86_64.rpm rust-debugger-common-1.60.0-3.u1.fos23.noarch.rpm rust-gdb-1.60.0-3.u1.fos23.noarch.rpm rust-lldb-1.60.0-3.u1.fos23.noarch.rpm cargo-1.60.0-3.u1.fos23.x86_64.rpm rustfmt-1.60.0-3.u1.fos23.x86_64.rpm rls-1.60.0-3.u1.fos23.x86_64.rpm clippy-1.60.0-3.u1.fos23.x86_64.rpm rust-src-1.60.0-3.u1.fos23.noarch.rpm rust-analysis-1.60.0-3.u1.fos23.x86_64.rpm rust-help-1.60.0-3.u1.fos23.x86_64.rpm rust-1.60.0-3.u1.fos23.aarch64.rpm rust-std-static-1.60.0-3.u1.fos23.aarch64.rpm cargo-1.60.0-3.u1.fos23.aarch64.rpm rustfmt-1.60.0-3.u1.fos23.aarch64.rpm rls-1.60.0-3.u1.fos23.aarch64.rpm clippy-1.60.0-3.u1.fos23.aarch64.rpm rust-analysis-1.60.0-3.u1.fos23.aarch64.rpm rust-help-1.60.0-3.u1.fos23.aarch64.rpm FusionOS-SA-2024-2105 Moderate FusionOS CVE-2018-14628:An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store. FusionOS samba-4.17.5-11.u7.fos23.x86_64.rpm samba-libs-4.17.5-11.u7.fos23.x86_64.rpm samba-client-4.17.5-11.u7.fos23.x86_64.rpm samba-client-libs-4.17.5-11.u7.fos23.x86_64.rpm samba-common-4.17.5-11.u7.fos23.x86_64.rpm samba-common-tools-4.17.5-11.u7.fos23.x86_64.rpm samba-dc-4.17.5-11.u7.fos23.x86_64.rpm samba-dc-provision-4.17.5-11.u7.fos23.x86_64.rpm samba-dc-libs-4.17.5-11.u7.fos23.x86_64.rpm samba-dc-bind-dlz-4.17.5-11.u7.fos23.x86_64.rpm samba-devel-4.17.5-11.u7.fos23.x86_64.rpm samba-vfs-glusterfs-4.17.5-11.u7.fos23.x86_64.rpm samba-krb5-printing-4.17.5-11.u7.fos23.x86_64.rpm libsmbclient-4.17.5-11.u7.fos23.x86_64.rpm libsmbclient-devel-4.17.5-11.u7.fos23.x86_64.rpm libwbclient-4.17.5-11.u7.fos23.x86_64.rpm libwbclient-devel-4.17.5-11.u7.fos23.x86_64.rpm python3-samba-4.17.5-11.u7.fos23.x86_64.rpm python3-samba-test-4.17.5-11.u7.fos23.x86_64.rpm python3-samba-dc-4.17.5-11.u7.fos23.x86_64.rpm samba-pidl-4.17.5-11.u7.fos23.noarch.rpm samba-test-4.17.5-11.u7.fos23.x86_64.rpm samba-usershares-4.17.5-11.u7.fos23.x86_64.rpm samba-winbind-4.17.5-11.u7.fos23.x86_64.rpm samba-winbind-clients-4.17.5-11.u7.fos23.x86_64.rpm samba-winbind-krb5-locator-4.17.5-11.u7.fos23.x86_64.rpm samba-winbind-modules-4.17.5-11.u7.fos23.x86_64.rpm ctdb-4.17.5-11.u7.fos23.x86_64.rpm samba-help-4.17.5-11.u7.fos23.x86_64.rpm samba-4.17.5-11.u7.fos23.aarch64.rpm samba-libs-4.17.5-11.u7.fos23.aarch64.rpm samba-client-4.17.5-11.u7.fos23.aarch64.rpm samba-client-libs-4.17.5-11.u7.fos23.aarch64.rpm samba-common-4.17.5-11.u7.fos23.aarch64.rpm samba-common-tools-4.17.5-11.u7.fos23.aarch64.rpm samba-dc-4.17.5-11.u7.fos23.aarch64.rpm samba-dc-provision-4.17.5-11.u7.fos23.aarch64.rpm samba-dc-libs-4.17.5-11.u7.fos23.aarch64.rpm samba-dc-bind-dlz-4.17.5-11.u7.fos23.aarch64.rpm samba-devel-4.17.5-11.u7.fos23.aarch64.rpm samba-krb5-printing-4.17.5-11.u7.fos23.aarch64.rpm libsmbclient-4.17.5-11.u7.fos23.aarch64.rpm libsmbclient-devel-4.17.5-11.u7.fos23.aarch64.rpm libwbclient-4.17.5-11.u7.fos23.aarch64.rpm libwbclient-devel-4.17.5-11.u7.fos23.aarch64.rpm python3-samba-4.17.5-11.u7.fos23.aarch64.rpm python3-samba-test-4.17.5-11.u7.fos23.aarch64.rpm python3-samba-dc-4.17.5-11.u7.fos23.aarch64.rpm samba-test-4.17.5-11.u7.fos23.aarch64.rpm samba-usershares-4.17.5-11.u7.fos23.aarch64.rpm samba-winbind-4.17.5-11.u7.fos23.aarch64.rpm samba-winbind-clients-4.17.5-11.u7.fos23.aarch64.rpm samba-winbind-krb5-locator-4.17.5-11.u7.fos23.aarch64.rpm samba-winbind-modules-4.17.5-11.u7.fos23.aarch64.rpm ctdb-4.17.5-11.u7.fos23.aarch64.rpm samba-help-4.17.5-11.u7.fos23.aarch64.rpm FusionOS-SA-2024-2106 Moderate FusionOS CVE-2023-0465:Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. CVE-2023-2650:Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(n^2) with 'n' being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature. The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer's certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low. CVE-2023-3446:Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. CVE-2024-0727:Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue. OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass(). We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. FusionOS shim-15.6-17.u12.fos23.x86_64.rpm shim-15.6-17.u12.fos23.aarch64.rpm FusionOS-SA-2024-2107 Moderate FusionOS CVE-2024-25617:Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote client or a remote server to perform Denial of Service when sending oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can be achieved if the request_header_max_size or reply_header_max_size settings are unchanged from the default. In Squid version 6.5 and later, the default setting of these parameters is safe. Squid will emit a critical warning in cache.log if the administrator is setting these parameters to unsafe values. Squid will not at this time prevent these settings from being changed to unsafe values. Users are advised to upgrade to version 6.5. There are no known workarounds for this vulnerability. This issue is also tracked as SQUID-2024:2 FusionOS squid-4.9-24.u5.fos23.x86_64.rpm squid-4.9-24.u5.fos23.aarch64.rpm FusionOS-SA-2024-2108 Important FusionOS CVE-2023-50387:Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records. CVE-2023-50868:The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations. CVE-2024-1488:A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether. FusionOS unbound-1.13.2-11.u4.fos23.x86_64.rpm unbound-libs-1.13.2-11.u4.fos23.x86_64.rpm unbound-devel-1.13.2-11.u4.fos23.x86_64.rpm python3-unbound-1.13.2-11.u4.fos23.x86_64.rpm unbound-help-1.13.2-11.u4.fos23.x86_64.rpm unbound-1.13.2-11.u4.fos23.aarch64.rpm unbound-libs-1.13.2-11.u4.fos23.aarch64.rpm unbound-devel-1.13.2-11.u4.fos23.aarch64.rpm python3-unbound-1.13.2-11.u4.fos23.aarch64.rpm unbound-help-1.13.2-11.u4.fos23.aarch64.rpm FusionOS-SA-2024-2109 Important FusionOS CVE-2023-44487:The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2022-45059:An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend. FusionOS varnish-7.4.2-1.fos23.x86_64.rpm varnish-devel-7.4.2-1.fos23.x86_64.rpm varnish-help-7.4.2-1.fos23.noarch.rpm varnish-7.4.2-1.fos23.aarch64.rpm varnish-devel-7.4.2-1.fos23.aarch64.rpm FusionOS-SA-2024-2110 Moderate FusionOS CVE-2023-52160:The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks. FusionOS wpa_supplicant-2.6-30.u1.fos23.x86_64.rpm wpa_supplicant-gui-2.6-30.u1.fos23.x86_64.rpm wpa_supplicant-help-2.6-30.u1.fos23.x86_64.rpm wpa_supplicant-2.6-30.u1.fos23.aarch64.rpm wpa_supplicant-gui-2.6-30.u1.fos23.aarch64.rpm wpa_supplicant-help-2.6-30.u1.fos23.aarch64.rpm FusionOS-SA-2024-2111 Important FusionOS CVE-2018-1311:The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable. FusionOS xerces-c-3.2.2-5.u1.fos23.x86_64.rpm xerces-c-devel-3.2.2-5.u1.fos23.x86_64.rpm xerces-c-help-3.2.2-5.u1.fos23.noarch.rpm xerces-c-3.2.2-5.u1.fos23.aarch64.rpm xerces-c-devel-3.2.2-5.u1.fos23.aarch64.rpm FusionOS-SA-2024-2112 Critical FusionOS CVE-2023-6816:A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used. FusionOS xorg-x11-server-1.20.11-28.u13.fos23.x86_64.rpm xorg-x11-server-common-1.20.11-28.u13.fos23.x86_64.rpm xorg-x11-server-Xnest-1.20.11-28.u13.fos23.x86_64.rpm xorg-x11-server-Xdmx-1.20.11-28.u13.fos23.x86_64.rpm xorg-x11-server-Xvfb-1.20.11-28.u13.fos23.x86_64.rpm xorg-x11-server-Xephyr-1.20.11-28.u13.fos23.x86_64.rpm xorg-x11-server-devel-1.20.11-28.u13.fos23.x86_64.rpm xorg-x11-server-help-1.20.11-28.u13.fos23.noarch.rpm xorg-x11-server-source-1.20.11-28.u13.fos23.noarch.rpm xorg-x11-server-1.20.11-28.u13.fos23.aarch64.rpm xorg-x11-server-common-1.20.11-28.u13.fos23.aarch64.rpm xorg-x11-server-Xnest-1.20.11-28.u13.fos23.aarch64.rpm xorg-x11-server-Xdmx-1.20.11-28.u13.fos23.aarch64.rpm xorg-x11-server-Xvfb-1.20.11-28.u13.fos23.aarch64.rpm xorg-x11-server-Xephyr-1.20.11-28.u13.fos23.aarch64.rpm xorg-x11-server-devel-1.20.11-28.u13.fos23.aarch64.rpm FusionOS-SA-2024-2113 Important FusionOS CVE-2022-40151:Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack. CVE-2022-41966:XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable. FusionOS xstream-1.4.20-1.u3.fos23.noarch.rpm xstream-javadoc-1.4.20-1.u3.fos23.noarch.rpm xstream-hibernate-1.4.20-1.u3.fos23.noarch.rpm xstream-benchmark-1.4.20-1.u3.fos23.noarch.rpm xstream-parent-1.4.20-1.u3.fos23.noarch.rpm FusionOS-SA-2024-2114 Important FusionOS CVE-2021-32142:Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in /src/libraw/src/libraw_datastream.cpp. FusionOS LibRaw-0.20.2-7.u4.fos23.x86_64.rpm LibRaw-devel-0.20.2-7.u4.fos23.x86_64.rpm LibRaw-0.20.2-7.u4.fos23.aarch64.rpm LibRaw-devel-0.20.2-7.u4.fos23.aarch64.rpm FusionOS-SA-2024-2115 Low FusionOS CVE-2024-31047:An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service (DoS) via the convert function of exrmultipart.cpp. FusionOS OpenEXR-3.1.5-3.u2.fos23.x86_64.rpm OpenEXR-libs-3.1.5-3.u2.fos23.x86_64.rpm OpenEXR-devel-3.1.5-3.u2.fos23.x86_64.rpm OpenEXR-3.1.5-3.u2.fos23.aarch64.rpm OpenEXR-libs-3.1.5-3.u2.fos23.aarch64.rpm OpenEXR-devel-3.1.5-3.u2.fos23.aarch64.rpm FusionOS-SA-2024-2116 Important FusionOS CVE-2019-25051:objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list). FusionOS aspell-0.60.6.1-30.u1.fos23.x86_64.rpm aspell-devel-0.60.6.1-30.u1.fos23.x86_64.rpm aspell-help-0.60.6.1-30.u1.fos23.x86_64.rpm aspell-0.60.6.1-30.u1.fos23.aarch64.rpm aspell-devel-0.60.6.1-30.u1.fos23.aarch64.rpm aspell-help-0.60.6.1-30.u1.fos23.aarch64.rpm FusionOS-SA-2024-2117 Important FusionOS CVE-2023-4408:The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. CVE-2023-50868:The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations. CVE-2023-5517:A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect <domain>;` is configured, and - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. CVE-2023-5679:A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. CVE-2023-5680:If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance. This issue affects BIND 9 versions 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. CVE-2023-6516:To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first allocated and then queued for later processing. It was discovered that if the resolver is continuously processing query patterns triggering this type of cache-database maintenance, `named` may not be able to handle the cleanup events in a timely manner. This in turn enables the list of queued cleanup events to grow infinitely large over time, allowing the configured `max-cache-size` limit to be significantly exceeded. This issue affects BIND 9 versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1. FusionOS bind-9.16.23-22.u7.fos23.x86_64.rpm bind-pkcs11-9.16.23-22.u7.fos23.x86_64.rpm bind-pkcs11-utils-9.16.23-22.u7.fos23.x86_64.rpm bind-pkcs11-libs-9.16.23-22.u7.fos23.x86_64.rpm bind-pkcs11-devel-9.16.23-22.u7.fos23.x86_64.rpm bind-libs-9.16.23-22.u7.fos23.x86_64.rpm bind-license-9.16.23-22.u7.fos23.noarch.rpm bind-utils-9.16.23-22.u7.fos23.x86_64.rpm bind-dnssec-utils-9.16.23-22.u7.fos23.x86_64.rpm bind-dnssec-doc-9.16.23-22.u7.fos23.noarch.rpm bind-devel-9.16.23-22.u7.fos23.x86_64.rpm bind-chroot-9.16.23-22.u7.fos23.x86_64.rpm python3-bind-9.16.23-22.u7.fos23.noarch.rpm bind-9.16.23-22.u7.fos23.aarch64.rpm bind-pkcs11-9.16.23-22.u7.fos23.aarch64.rpm bind-pkcs11-utils-9.16.23-22.u7.fos23.aarch64.rpm bind-pkcs11-libs-9.16.23-22.u7.fos23.aarch64.rpm bind-pkcs11-devel-9.16.23-22.u7.fos23.aarch64.rpm bind-libs-9.16.23-22.u7.fos23.aarch64.rpm bind-utils-9.16.23-22.u7.fos23.aarch64.rpm bind-dnssec-utils-9.16.23-22.u7.fos23.aarch64.rpm bind-devel-9.16.23-22.u7.fos23.aarch64.rpm bind-chroot-9.16.23-22.u7.fos23.aarch64.rpm FusionOS-SA-2024-2118 Important FusionOS CVE-2024-2398:When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application. FusionOS curl-7.79.1-28.u14.fos23.x86_64.rpm libcurl-7.79.1-28.u14.fos23.x86_64.rpm libcurl-devel-7.79.1-28.u14.fos23.x86_64.rpm curl-help-7.79.1-28.u14.fos23.noarch.rpm curl-7.79.1-28.u14.fos23.aarch64.rpm libcurl-7.79.1-28.u14.fos23.aarch64.rpm libcurl-devel-7.79.1-28.u14.fos23.aarch64.rpm FusionOS-SA-2024-2119 Low FusionOS CVE-2024-2511:Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue. FusionOS edk2-devel-202011-17.u6.fos23.x86_64.rpm python3-edk2-devel-202011-17.u6.fos23.noarch.rpm edk2-help-202011-17.u6.fos23.noarch.rpm edk2-ovmf-202011-17.u6.fos23.noarch.rpm edk2-devel-202011-17.u6.fos23.aarch64.rpm FusionOS-SA-2024-2120 Low FusionOS CVE-2024-30203:In Emacs before 29.3, Gnus treats inline MIME contents as trusted. CVE-2024-30204:In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments. CVE-2024-30205:In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23. FusionOS emacs-27.2-13.u5.fos23.x86_64.rpm emacs-devel-27.2-13.u5.fos23.x86_64.rpm emacs-lucid-27.2-13.u5.fos23.x86_64.rpm emacs-nox-27.2-13.u5.fos23.x86_64.rpm emacs-common-27.2-13.u5.fos23.x86_64.rpm emacs-terminal-27.2-13.u5.fos23.noarch.rpm emacs-filesystem-27.2-13.u5.fos23.noarch.rpm emacs-help-27.2-13.u5.fos23.noarch.rpm emacs-27.2-13.u5.fos23.aarch64.rpm emacs-devel-27.2-13.u5.fos23.aarch64.rpm emacs-lucid-27.2-13.u5.fos23.aarch64.rpm emacs-nox-27.2-13.u5.fos23.aarch64.rpm emacs-common-27.2-13.u5.fos23.aarch64.rpm FusionOS-SA-2024-2121 Important FusionOS CVE-2023-52426:libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time. CVE-2024-28757:libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate). CVE-2023-52425:libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed. FusionOS expat-2.4.1-11.u1.fos23.x86_64.rpm expat-devel-2.4.1-11.u1.fos23.x86_64.rpm expat-help-2.4.1-11.u1.fos23.noarch.rpm expat-2.4.1-11.u1.fos23.aarch64.rpm expat-devel-2.4.1-11.u1.fos23.aarch64.rpm FusionOS-SA-2024-2122 Important FusionOS CVE-2024-32462:Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6. CVE-2023-28100:Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is primarily designed to be used in a Wayland or X11 graphical environment. CVE-2023-28101:Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust. FusionOS flatpak-1.10.2-8.u3.fos23.x86_64.rpm flatpak-devel-1.10.2-8.u3.fos23.x86_64.rpm flatpak-help-1.10.2-8.u3.fos23.noarch.rpm flatpak-1.10.2-8.u3.fos23.aarch64.rpm flatpak-devel-1.10.2-8.u3.fos23.aarch64.rpm FusionOS-SA-2024-2123 Important FusionOS CVE-2024-2961:The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable. FusionOS glibc-2.34-146.u21.fos23.x86_64.rpm glibc-common-2.34-146.u21.fos23.x86_64.rpm glibc-all-langpacks-2.34-146.u21.fos23.x86_64.rpm glibc-locale-source-2.34-146.u21.fos23.x86_64.rpm glibc-locale-archive-2.34-146.u21.fos23.x86_64.rpm glibc-devel-2.34-146.u21.fos23.x86_64.rpm nscd-2.34-146.u21.fos23.x86_64.rpm nss_modules-2.34-146.u21.fos23.x86_64.rpm glibc-nss-devel-2.34-146.u21.fos23.x86_64.rpm libnsl-2.34-146.u21.fos23.x86_64.rpm glibc-debugutils-2.34-146.u21.fos23.x86_64.rpm glibc-help-2.34-146.u21.fos23.noarch.rpm glibc-compat-2.17-2.34-146.u21.fos23.x86_64.rpm glibc-2.34-146.u21.fos23.aarch64.rpm glibc-common-2.34-146.u21.fos23.aarch64.rpm glibc-all-langpacks-2.34-146.u21.fos23.aarch64.rpm glibc-locale-source-2.34-146.u21.fos23.aarch64.rpm glibc-locale-archive-2.34-146.u21.fos23.aarch64.rpm glibc-devel-2.34-146.u21.fos23.aarch64.rpm nscd-2.34-146.u21.fos23.aarch64.rpm nss_modules-2.34-146.u21.fos23.aarch64.rpm glibc-nss-devel-2.34-146.u21.fos23.aarch64.rpm libnsl-2.34-146.u21.fos23.aarch64.rpm glibc-debugutils-2.34-146.u21.fos23.aarch64.rpm glibc-compat-2.17-2.34-146.u21.fos23.aarch64.rpm FusionOS-SA-2024-2124 Moderate FusionOS CVE-2024-28835:A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command. CVE-2024-28834:A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel. FusionOS gnutls-3.7.2-14.u7.fos23.x86_64.rpm gnutls-devel-3.7.2-14.u7.fos23.x86_64.rpm gnutls-utils-3.7.2-14.u7.fos23.x86_64.rpm gnutls-help-3.7.2-14.u7.fos23.noarch.rpm gnutls-3.7.2-14.u7.fos23.aarch64.rpm gnutls-devel-3.7.2-14.u7.fos23.aarch64.rpm gnutls-utils-3.7.2-14.u7.fos23.aarch64.rpm FusionOS-SA-2024-2125 Important FusionOS CVE-2024-27316:HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion. FusionOS httpd-2.4.51-20.u10.fos23.x86_64.rpm httpd-devel-2.4.51-20.u10.fos23.x86_64.rpm httpd-help-2.4.51-20.u10.fos23.noarch.rpm httpd-filesystem-2.4.51-20.u10.fos23.noarch.rpm httpd-tools-2.4.51-20.u10.fos23.x86_64.rpm mod_ssl-2.4.51-20.u10.fos23.x86_64.rpm mod_md-2.4.51-20.u10.fos23.x86_64.rpm mod_proxy_html-2.4.51-20.u10.fos23.x86_64.rpm mod_ldap-2.4.51-20.u10.fos23.x86_64.rpm mod_session-2.4.51-20.u10.fos23.x86_64.rpm httpd-2.4.51-20.u10.fos23.aarch64.rpm httpd-devel-2.4.51-20.u10.fos23.aarch64.rpm httpd-tools-2.4.51-20.u10.fos23.aarch64.rpm mod_ssl-2.4.51-20.u10.fos23.aarch64.rpm mod_md-2.4.51-20.u10.fos23.aarch64.rpm mod_proxy_html-2.4.51-20.u10.fos23.aarch64.rpm mod_ldap-2.4.51-20.u10.fos23.aarch64.rpm mod_session-2.4.51-20.u10.fos23.aarch64.rpm FusionOS-SA-2024-2126 Moderate FusionOS CVE-2023-7250:A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server to hang indefinitely waiting for the remainder or until the connection gets closed. This will prevent other connections to the server, leading to a denial of service. FusionOS iperf3-3.16-1.u1.fos23.x86_64.rpm iperf3-devel-3.16-1.u1.fos23.x86_64.rpm iperf3-help-3.16-1.u1.fos23.noarch.rpm iperf3-3.16-1.u1.fos23.aarch64.rpm iperf3-devel-3.16-1.u1.fos23.aarch64.rpm FusionOS-SA-2024-2127 Important FusionOS CVE-2023-50967:latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value. FusionOS jose-11-2.u1.fos23.x86_64.rpm jose-devel-11-2.u1.fos23.x86_64.rpm jose-help-11-2.u1.fos23.x86_64.rpm jose-11-2.u1.fos23.aarch64.rpm jose-devel-11-2.u1.fos23.aarch64.rpm jose-help-11-2.u1.fos23.aarch64.rpm FusionOS-SA-2024-2128 Important FusionOS CVE-2024-1151:A vulnerability was reported in the Open vSwitch sub-component in the Linux Kernel. The flaw occurs when a recursive operation of code push recursively calls into the code block. The OVS module does not validate the stack depth, pushing too many frames and causing a stack overflow. As a result, this can lead to a crash or other related issues. CVE-2023-52443:In the Linux kernel, the following vulnerability has been resolved: apparmor: avoid crash when parsed profile name is empty When processing a packed profile in unpack_profile() described like "profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}" a string ":samba-dcerpcd" is unpacked as a fully-qualified name and then passed to aa_splitn_fqname(). aa_splitn_fqname() treats ":samba-dcerpcd" as only containing a namespace. Thus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Later aa_alloc_profile() crashes as the new profile name is NULL now. general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 6 PID: 1657 Comm: apparmor_parser Not tainted 6.7.0-rc2-dirty #16 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:strlen+0x1e/0xa0 Call Trace: <TASK> ? strlen+0x1e/0xa0 aa_policy_init+0x1bb/0x230 aa_alloc_profile+0xb1/0x480 unpack_profile+0x3bc/0x4960 aa_unpack+0x309/0x15e0 aa_replace_profiles+0x213/0x33c0 policy_update+0x261/0x370 profile_replace+0x20e/0x2a0 vfs_write+0x2af/0xe00 ksys_write+0x126/0x250 do_syscall_64+0x46/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK> ---[ end trace 0000000000000000 ]--- RIP: 0010:strlen+0x1e/0xa0 It seems such behaviour of aa_splitn_fqname() is expected and checked in other places where it is called (e.g. aa_remove_profiles). Well, there is an explicit comment "a ns name without a following profile is allowed" inside. AFAICS, nothing can prevent unpacked "name" to be in form like ":samba-dcerpcd" - it is passed from userspace. Deny the whole profile set replacement in such case and inform user with EPROTO and an explaining message. Found by Linux Verification Center (linuxtesting.org). CVE-2023-52463:In the Linux kernel, the following vulnerability has been resolved: efivarfs: force RO when remounting if SetVariable is not supported If SetVariable at runtime is not supported by the firmware we never assign a callback for that function. At the same time mount the efivarfs as RO so no one can call that. However, we never check the permission flags when someone remounts the filesystem as RW. As a result this leads to a crash looking like this: $ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK [ 303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 303.280482] Mem abort info: [ 303.280854] ESR = 0x0000000086000004 [ 303.281338] EC = 0x21: IABT (current EL), IL = 32 bits [ 303.282016] SET = 0, FnV = 0 [ 303.282414] EA = 0, S1PTW = 0 [ 303.282821] FSC = 0x04: level 0 translation fault [ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000 [ 303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP [ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 [ 303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1 [ 303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023 [ 303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 303.292123] pc : 0x0 [ 303.292443] lr : efivar_set_variable_locked+0x74/0xec [ 303.293156] sp : ffff800008673c10 [ 303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 [ 303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027 [ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000 [ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000 [ 303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54 [ 303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4 [ 303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002 [ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201 [ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc [ 303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000 [ 303.303341] Call trace: [ 303.303679] 0x0 [ 303.303938] efivar_entry_set_get_size+0x98/0x16c [ 303.304585] efivarfs_file_write+0xd0/0x1a4 [ 303.305148] vfs_write+0xc4/0x2e4 [ 303.305601] ksys_write+0x70/0x104 [ 303.306073] __arm64_sys_write+0x1c/0x28 [ 303.306622] invoke_syscall+0x48/0x114 [ 303.307156] el0_svc_common.constprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [ 303.308702] el0t_64_sync_handler+0xf4/0x120 [ 303.309293] el0t_64_sync+0x190/0x194 [ 303.309794] Code: ???????? ???????? ???????? ???????? (????????) [ 303.310612] ---[ end trace 0000000000000000 ]--- Fix this by adding a .reconfigure() function to the fs operations which we can use to check the requested flags and deny anything that's not RO if the firmware doesn't implement SetVariable at runtime. CVE-2024-26598:In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgic_its_check_cache() does not elevate the refcount on the vgic_irq before dropping the lock that serializes refcount changes. Have vgic_its_check_cache() raise the refcount on the returned vgic_irq and add the corresponding decrement after queueing the interrupt. CVE-2023-52448:In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in gfs2_rgrp_dump() to prevent that. CVE-2024-26595:In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam' [1]. Fix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam(). [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Call Trace: mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b CVE-2023-52436:In the Linux kernel, the following vulnerability has been resolved: f2fs: explicitly null-terminate the xattr list When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the unused xattr space is always zeroed. CVE-2024-23850:In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and crash because a subvolume can be read out too soon after its root item is inserted upon subvolume creation. CVE-2023-52438:In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in shinker's callback The mmap read lock is used during the shrinker's callback, which means that using alloc->vma pointer isn't safe as it can race with munmap(). As of commit dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap") the mmap lock is downgraded after the vma has been isolated. I was able to reproduce this issue by manually adding some delays and triggering page reclaiming through the shrinker's debug sysfs. The following KASAN report confirms the UAF: ================================================================== BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8 Read of size 8 at addr ffff356ed50e50f0 by task bash/478 CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70 Hardware name: linux,dummy-virt (DT) Call trace: zap_page_range_single+0x470/0x4b8 binder_alloc_free_page+0x608/0xadc __list_lru_walk_one+0x130/0x3b0 list_lru_walk_node+0xc4/0x22c binder_shrink_scan+0x108/0x1dc shrinker_debugfs_scan_write+0x2b4/0x500 full_proxy_write+0xd4/0x140 vfs_write+0x1ac/0x758 ksys_write+0xf0/0x1dc __arm64_sys_write+0x6c/0x9c Allocated by task 492: kmem_cache_alloc+0x130/0x368 vm_area_alloc+0x2c/0x190 mmap_region+0x258/0x18bc do_mmap+0x694/0xa60 vm_mmap_pgoff+0x170/0x29c ksys_mmap_pgoff+0x290/0x3a0 __arm64_sys_mmap+0xcc/0x144 Freed by task 491: kmem_cache_free+0x17c/0x3c8 vm_area_free_rcu_cb+0x74/0x98 rcu_core+0xa38/0x26d4 rcu_core_si+0x10/0x1c __do_softirq+0x2fc/0xd24 Last potentially related work creation: __call_rcu_common.constprop.0+0x6c/0xba0 call_rcu+0x10/0x1c vm_area_free+0x18/0x24 remove_vma+0xe4/0x118 do_vmi_align_munmap.isra.0+0x718/0xb5c do_vmi_munmap+0xdc/0x1fc __vm_munmap+0x10c/0x278 __arm64_sys_munmap+0x58/0x7c Fix this issue by performing instead a vma_lookup() which will fail to find the vma that was isolated before the mmap lock downgrade. Note that this option has better performance than upgrading to a mmap write lock which would increase contention. Plus, mmap_write_trylock() has been recently removed anyway. CVE-2024-26583:In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past that point risks touching already freed data. Try to avoid the locking and extra flags altogether. Have the main thread hold an extra reference, this way we can depend solely on the atomic ref counter for synchronization. Don't futz with reiniting the completion, either, we are now tightly controlling when completion fires. CVE-2023-52439:In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev) ------------------------------------------------------- In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2 will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock. CVE-2023-52522:In the Linux kernel, the following vulnerability has been resolved: net: fix possible store tearing in neigh_periodic_work() While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an RCU protected item from a list. Readers use rcu_deference(*np), we need to use either rcu_assign_pointer() or WRITE_ONCE() on writer side to prevent store tearing. I use rcu_assign_pointer() to have lockdep support, this was the choice made in neigh_flush_dev(). CVE-2023-52573:In the Linux kernel, the following vulnerability has been resolved: net: rds: Fix possible NULL-pointer dereference In rds_rdma_cm_event_handler_cmn() check, if conn pointer exists before dereferencing it as rdma_set_service_type() argument Found by Linux Verification Center (linuxtesting.org) with SVACE. CVE-2024-22099:NULL Pointer Dereference vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (net, bluetooth modules) allows Overflow Buffers. This vulnerability is associated with program files /net/bluetooth/rfcomm/core.C. This issue affects Linux kernel: v2.6.12-rc2. CVE-2024-23851:copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes, and crash, because of a missing param_kernel->data_size check. This is related to ctl_ioctl. CVE-2023-52510:In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: Fix a potential UAF in ca8210_probe If of_clk_add_provider() fails in ca8210_register_ext_clock(), it calls clk_unregister() to release priv->clk and returns an error. However, the caller ca8210_probe() then calls ca8210_remove(), where priv->clk is freed again in ca8210_unregister_ext_clock(). In this case, a use-after-free may happen in the second time we call clk_unregister(). Fix this by removing the first clk_unregister(). Also, priv->clk could be an error code on failure of clk_register_fixed_rate(). Use IS_ERR_OR_NULL to catch this case in ca8210_unregister_ext_clock(). CVE-2023-52458:In the Linux kernel, the following vulnerability has been resolved: block: add check that partition length needs to be aligned with block size Before calling add partition or resize partition, there is no check on whether the length is aligned with the logical block size. If the logical block size of the disk is larger than 512 bytes, then the partition size maybe not the multiple of the logical block size, and when the last sector is read, bio_truncate() will adjust the bio size, resulting in an IO error if the size of the read command is smaller than the logical block size.If integrity data is supported, this will also result in a null pointer dereference when calling bio_integrity_free. CVE-2021-47014:In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix wild memory access when clearing fragments while testing re-assembly/re-fragmentation using act_ct, it's possible to observe a crash like the following one: KASAN: maybe wild-memory-access in range [0x0001000000000448-0x000100000000044f] CPU: 50 PID: 0 Comm: swapper/50 Tainted: G S 5.12.0-rc7+ #424 Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017 RIP: 0010:inet_frag_rbtree_purge+0x50/0xc0 Code: 00 fc ff df 48 89 c3 31 ed 48 89 df e8 a9 7a 38 ff 4c 89 fe 48 89 df 49 89 c6 e8 5b 3a 38 ff 48 8d 7b 40 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 75 59 48 8d bb d0 00 00 00 4c 8b 6b 40 48 89 f8 48 RSP: 0018:ffff888c31449db8 EFLAGS: 00010203 RAX: 0000200000000089 RBX: 000100000000040e RCX: ffffffff989eb960 RDX: 0000000000000140 RSI: ffffffff97cfb977 RDI: 000100000000044e RBP: 0000000000000900 R08: 0000000000000000 R09: ffffed1186289350 R10: 0000000000000003 R11: ffffed1186289350 R12: dffffc0000000000 R13: 000100000000040e R14: 0000000000000000 R15: ffff888155e02160 FS: 0000000000000000(0000) GS:ffff888c31440000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005600cb70a5b8 CR3: 0000000a2c014005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> inet_frag_destroy+0xa9/0x150 call_timer_fn+0x2d/0x180 run_timer_softirq+0x4fe/0xe70 __do_softirq+0x197/0x5a0 irq_exit_rcu+0x1de/0x200 sysvec_apic_timer_interrupt+0x6b/0x80 </IRQ> when act_ct temporarily stores an IP fragment, restoring the skb qdisc cb results in putting random data in FRAG_CB(), and this causes those "wild" memory accesses later, when the rbtree is purged. Never overwrite the skb cb in case tcf_ct_handle_fragments() returns -EINPROGRESS. CVE-2021-47036:In the Linux kernel, the following vulnerability has been resolved: udp: skip L4 aggregation for UDP tunnel packets If NETIF_F_GRO_FRAGLIST or NETIF_F_GRO_UDP_FWD are enabled, and there are UDP tunnels available in the system, udp_gro_receive() could end-up doing L4 aggregation (either SKB_GSO_UDP_L4 or SKB_GSO_FRAGLIST) at the outer UDP tunnel level for packets effectively carrying and UDP tunnel header. That could cause inner protocol corruption. If e.g. the relevant packets carry a vxlan header, different vxlan ids will be ignored/ aggregated to the same GSO packet. Inner headers will be ignored, too, so that e.g. TCP over vxlan push packets will be held in the GRO engine till the next flush, etc. Just skip the SKB_GSO_UDP_L4 and SKB_GSO_FRAGLIST code path if the current packet could land in a UDP tunnel, and let udp_gro_receive() do GRO via udp_sk(sk)->gro_receive. The check implemented in this patch is broader than what is strictly needed, as the existing UDP tunnel could be e.g. configured on top of a different device: we could end-up skipping GRO at-all for some packets. Anyhow, that is a very thin corner case and covering it will add quite a bit of complexity. v1 -> v2: - hopefully clarify the commit message CVE-2023-52566:In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page. NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run that code path by intentionally modifying the userland GC library or by calling the GC ioctl directly. [konishi.ryusuke@gmail.com: NOTE added to the commit log] CVE-2021-47028:In the Linux kernel, the following vulnerability has been resolved: mt76: mt7915: fix txrate reporting Properly check rate_info to fix unexpected reporting. [ 1215.161863] Call trace: [ 1215.164307] cfg80211_calculate_bitrate+0x124/0x200 [cfg80211] [ 1215.170139] ieee80211s_update_metric+0x80/0xc0 [mac80211] [ 1215.175624] ieee80211_tx_status_ext+0x508/0x838 [mac80211] [ 1215.181190] mt7915_mcu_get_rx_rate+0x28c/0x8d0 [mt7915e] [ 1215.186580] mt7915_mac_tx_free+0x324/0x7c0 [mt7915e] [ 1215.191623] mt7915_queue_rx_skb+0xa8/0xd0 [mt7915e] [ 1215.196582] mt76_dma_cleanup+0x7b0/0x11d0 [mt76] [ 1215.201276] __napi_poll+0x38/0xf8 [ 1215.204668] napi_workfn+0x40/0x80 [ 1215.208062] process_one_work+0x1fc/0x390 [ 1215.212062] worker_thread+0x48/0x4d0 [ 1215.215715] kthread+0x120/0x128 [ 1215.218935] ret_from_fork+0x10/0x1c CVE-2023-52568:In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race The SGX EPC reclaimer (ksgxd) may reclaim the SECS EPC page for an enclave and set secs.epc_page to NULL. The SECS page is used for EAUG and ELDU in the SGX page fault handler. However, the NULL check for secs.epc_page is only done for ELDU, not EAUG before being used. Fix this by doing the same NULL check and reloading of the SECS page as needed for both EAUG and ELDU. The SECS page holds global enclave metadata. It can only be reclaimed when there are no other enclave pages remaining. At that point, virtually nothing can be done with the enclave until the SECS page is paged back in. An enclave can not run nor generate page faults without a resident SECS page. But it is still possible for a #PF for a non-SECS page to race with paging out the SECS page: when the last resident non-SECS page A triggers a #PF in a non-resident page B, and then page A and the SECS both are paged out before the #PF on B is handled. Hitting this bug requires that race triggered with a #PF for EAUG. Following is a trace when it happens. BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:sgx_encl_eaug_page+0xc7/0x210 Call Trace: ? __kmem_cache_alloc_node+0x16a/0x440 ? xa_load+0x6e/0xa0 sgx_vma_fault+0x119/0x230 __do_fault+0x36/0x140 do_fault+0x12f/0x400 __handle_mm_fault+0x728/0x1110 handle_mm_fault+0x105/0x310 do_user_addr_fault+0x1ee/0x750 ? __this_cpu_preempt_check+0x13/0x20 exc_page_fault+0x76/0x180 asm_exc_page_fault+0x27/0x30 CVE-2023-52449:In the Linux kernel, the following vulnerability has been resolved: mtd: Fix gluebi NULL pointer dereference caused by ftl notifier If both ftl.ko and gluebi.ko are loaded, the notifier of ftl triggers NULL pointer dereference when trying to access ‘gluebi->desc’ in gluebi_read(). ubi_gluebi_init ubi_register_volume_notifier ubi_enumerate_volumes ubi_notify_all gluebi_notify nb->notifier_call() gluebi_create mtd_device_register mtd_device_parse_register add_mtd_device blktrans_notify_add not->add() ftl_add_mtd tr->add_mtd() scan_header mtd_read mtd_read_oob mtd_read_oob_std gluebi_read mtd->read() gluebi->desc - NULL Detailed reproduction information available at the Link [1], In the normal case, obtain gluebi->desc in the gluebi_get_device(), and access gluebi->desc in the gluebi_read(). However, gluebi_get_device() is not executed in advance in the ftl_add_mtd() process, which leads to NULL pointer dereference. The solution for the gluebi module is to run jffs2 on the UBI volume without considering working with ftl or mtdblock [2]. Therefore, this problem can be avoided by preventing gluebi from creating the mtdblock device after creating mtd partition of the type MTD_UBIVOLUME. CVE-2023-52447:In the Linux kernel, the following vulnerability has been resolved: bpf: Defer the free of inner map when necessary When updating or deleting an inner map in map array or map htab, the map may still be accessed by non-sleepable program or sleepable program. However bpf_map_fd_put_ptr() decreases the ref-counter of the inner map directly through bpf_map_put(), if the ref-counter is the last one (which is true for most cases), the inner map will be freed by ops->map_free() in a kworker. But for now, most .map_free() callbacks don't use synchronize_rcu() or its variants to wait for the elapse of a RCU grace period, so after the invocation of ops->map_free completes, the bpf program which is accessing the inner map may incur use-after-free problem. Fix the free of inner map by invoking bpf_map_free_deferred() after both one RCU grace period and one tasks trace RCU grace period if the inner map has been removed from the outer map before. The deferment is accomplished by using call_rcu() or call_rcu_tasks_trace() when releasing the last ref-counter of bpf map. The newly-added rcu_head field in bpf_map shares the same storage space with work field to reduce the size of bpf_map. CVE-2023-52452:In the Linux kernel, the following vulnerability has been resolved: bpf: Fix accesses to uninit stack slots Privileged programs are supposed to be able to read uninitialized stack memory (ever since 6715df8d5) but, before this patch, these accesses were permitted inconsistently. In particular, accesses were permitted above state->allocated_stack, but not below it. In other words, if the stack was already "large enough", the access was permitted, but otherwise the access was rejected instead of being allowed to "grow the stack". This undesired rejection was happening in two places: - in check_stack_slot_within_bounds() - in check_stack_range_initialized() This patch arranges for these accesses to be permitted. A bunch of tests that were relying on the old rejection had to change; all of them were changed to add also run unprivileged, in which case the old behavior persists. One tests couldn't be updated - global_func16 - because it can't run unprivileged for other reasons. This patch also fixes the tracking of the stack size for variable-offset reads. This second fix is bundled in the same commit as the first one because they're inter-related. Before this patch, writes to the stack using registers containing a variable offset (as opposed to registers with fixed, known values) were not properly contributing to the function's needed stack size. As a result, it was possible for a program to verify, but then to attempt to read out-of-bounds data at runtime because a too small stack had been allocated for it. Each function tracks the size of the stack it needs in bpf_subprog_info.stack_depth, which is maintained by update_stack_depth(). For regular memory accesses, check_mem_access() was calling update_state_depth() but it was passing in only the fixed part of the offset register, ignoring the variable offset. This was incorrect; the minimum possible value of that register should be used instead. This tracking is now fixed by centralizing the tracking of stack size in grow_stack_state(), and by lifting the calls to grow_stack_state() to check_stack_access_within_bounds() as suggested by Andrii. The code is now simpler and more convincingly tracks the correct maximum stack size. check_stack_range_initialized() can now rely on enough stack having been allocated for the access; this helps with the fix for the first issue. A few tests were changed to also check the stack depth computation. The one that fails without this patch is verifier_var_off:stack_write_priv_vs_unpriv. CVE-2023-52451:In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/memhp: Fix access beyond end of drmem array dlpar_memory_remove_by_index() may access beyond the bounds of the drmem lmb array when the LMB lookup fails to match an entry with the given DRC index. When the search fails, the cursor is left pointing to &drmem_info->lmbs[drmem_info->n_lmbs], which is one element past the last valid entry in the array. The debug message at the end of the function then dereferences this pointer: pr_debug("Failed to hot-remove memory at %llx\n", lmb->base_addr); This was found by inspection and confirmed with KASAN: pseries-hotplug-mem: Attempting to hot-remove LMB, drc index 1234 ================================================================== BUG: KASAN: slab-out-of-bounds in dlpar_memory+0x298/0x1658 Read of size 8 at addr c000000364e97fd0 by task bash/949 dump_stack_lvl+0xa4/0xfc (unreliable) print_report+0x214/0x63c kasan_report+0x140/0x2e0 __asan_load8+0xa8/0xe0 dlpar_memory+0x298/0x1658 handle_dlpar_errorlog+0x130/0x1d0 dlpar_store+0x18c/0x3e0 kobj_attr_store+0x68/0xa0 sysfs_kf_write+0xc4/0x110 kernfs_fop_write_iter+0x26c/0x390 vfs_write+0x2d4/0x4e0 ksys_write+0xac/0x1a0 system_call_exception+0x268/0x530 system_call_vectored_common+0x15c/0x2ec Allocated by task 1: kasan_save_stack+0x48/0x80 kasan_set_track+0x34/0x50 kasan_save_alloc_info+0x34/0x50 __kasan_kmalloc+0xd0/0x120 __kmalloc+0x8c/0x320 kmalloc_array.constprop.0+0x48/0x5c drmem_init+0x2a0/0x41c do_one_initcall+0xe0/0x5c0 kernel_init_freeable+0x4ec/0x5a0 kernel_init+0x30/0x1e0 ret_from_kernel_user_thread+0x14/0x1c The buggy address belongs to the object at c000000364e80000 which belongs to the cache kmalloc-128k of size 131072 The buggy address is located 0 bytes to the right of allocated 98256-byte region [c000000364e80000, c000000364e97fd0) ================================================================== pseries-hotplug-mem: Failed to hot-remove memory at 0 Log failed lookups with a separate message and dereference the cursor only when it points to a valid entry. CVE-2023-52583:In the Linux kernel, the following vulnerability has been resolved: ceph: fix deadlock or deadcode of misusing dget() The lock order is incorrect between denty and its parent, we should always make sure that the parent get the lock first. But since this deadcode is never used and the parent dir will always be set from the callers, let's just remove it. CVE-2023-52606:In the Linux kernel, the following vulnerability has been resolved: powerpc/lib: Validate size for vector operations Some of the fp/vmx code in sstep.c assume a certain maximum size for the instructions being emulated. The size of those operations however is determined separately in analyse_instr(). Add a check to validate the assumption on the maximum size of the operations, so as to prevent any unintended kernel stack corruption. CVE-2023-52486:In the Linux kernel, the following vulnerability has been resolved: drm: Don't unref the same fb many times by mistake due to deadlock handling If we get a deadlock after the fb lookup in drm_mode_page_flip_ioctl() we proceed to unref the fb and then retry the whole thing from the top. But we forget to reset the fb pointer back to NULL, and so if we then get another error during the retry, before the fb lookup, we proceed the unref the same fb again without having gotten another reference. The end result is that the fb will (eventually) end up being freed while it's still in use. Reset fb to NULL once we've unreffed it to avoid doing it again until we've done another fb lookup. This turned out to be pretty easy to hit on a DG2 when doing async flips (and CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y). The first symptom I saw that drm_closefb() simply got stuck in a busy loop while walking the framebuffer list. Fortunately I was able to convince it to oops instead, and from there it was easier to track down the culprit. CVE-2021-46987:In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock when cloning inline extents and using qgroups There are a few exceptional cases where cloning an inline extent needs to copy the inline extent data into a page of the destination inode. When this happens, we end up starting a transaction while having a dirty page for the destination inode and while having the range locked in the destination's inode iotree too. Because when reserving metadata space for a transaction we may need to flush existing delalloc in case there is not enough free space, we have a mechanism in place to prevent a deadlock, which was introduced in commit 3d45f221ce627d ("btrfs: fix deadlock when cloning inline extent and low on free metadata space"). However when using qgroups, a transaction also reserves metadata qgroup space, which can also result in flushing delalloc in case there is not enough available space at the moment. When this happens we deadlock, since flushing delalloc requires locking the file range in the inode's iotree and the range was already locked at the very beginning of the clone operation, before attempting to start the transaction. When this issue happens, stack traces like the following are reported: [72747.556262] task:kworker/u81:9 state:D stack: 0 pid: 225 ppid: 2 flags:0x00004000 [72747.556268] Workqueue: writeback wb_workfn (flush-btrfs-1142) [72747.556271] Call Trace: [72747.556273] __schedule+0x296/0x760 [72747.556277] schedule+0x3c/0xa0 [72747.556279] io_schedule+0x12/0x40 [72747.556284] __lock_page+0x13c/0x280 [72747.556287] ? generic_file_readonly_mmap+0x70/0x70 [72747.556325] extent_write_cache_pages+0x22a/0x440 [btrfs] [72747.556331] ? __set_page_dirty_nobuffers+0xe7/0x160 [72747.556358] ? set_extent_buffer_dirty+0x5e/0x80 [btrfs] [72747.556362] ? update_group_capacity+0x25/0x210 [72747.556366] ? cpumask_next_and+0x1a/0x20 [72747.556391] extent_writepages+0x44/0xa0 [btrfs] [72747.556394] do_writepages+0x41/0xd0 [72747.556398] __writeback_single_inode+0x39/0x2a0 [72747.556403] writeback_sb_inodes+0x1ea/0x440 [72747.556407] __writeback_inodes_wb+0x5f/0xc0 [72747.556410] wb_writeback+0x235/0x2b0 [72747.556414] ? get_nr_inodes+0x35/0x50 [72747.556417] wb_workfn+0x354/0x490 [72747.556420] ? newidle_balance+0x2c5/0x3e0 [72747.556424] process_one_work+0x1aa/0x340 [72747.556426] worker_thread+0x30/0x390 [72747.556429] ? create_worker+0x1a0/0x1a0 [72747.556432] kthread+0x116/0x130 [72747.556435] ? kthread_park+0x80/0x80 [72747.556438] ret_from_fork+0x1f/0x30 [72747.566958] Workqueue: btrfs-flush_delalloc btrfs_work_helper [btrfs] [72747.566961] Call Trace: [72747.566964] __schedule+0x296/0x760 [72747.566968] ? finish_wait+0x80/0x80 [72747.566970] schedule+0x3c/0xa0 [72747.566995] wait_extent_bit.constprop.68+0x13b/0x1c0 [btrfs] [72747.566999] ? finish_wait+0x80/0x80 [72747.567024] lock_extent_bits+0x37/0x90 [btrfs] [72747.567047] btrfs_invalidatepage+0x299/0x2c0 [btrfs] [72747.567051] ? find_get_pages_range_tag+0x2cd/0x380 [72747.567076] __extent_writepage+0x203/0x320 [btrfs] [72747.567102] extent_write_cache_pages+0x2bb/0x440 [btrfs] [72747.567106] ? update_load_avg+0x7e/0x5f0 [72747.567109] ? enqueue_entity+0xf4/0x6f0 [72747.567134] extent_writepages+0x44/0xa0 [btrfs] [72747.567137] ? enqueue_task_fair+0x93/0x6f0 [72747.567140] do_writepages+0x41/0xd0 [72747.567144] __filemap_fdatawrite_range+0xc7/0x100 [72747.567167] btrfs_run_delalloc_work+0x17/0x40 [btrfs] [72747.567195] btrfs_work_helper+0xc2/0x300 [btrfs] [72747.567200] process_one_work+0x1aa/0x340 [72747.567202] worker_thread+0x30/0x390 [72747.567205] ? create_worker+0x1a0/0x1a0 [72747.567208] kthread+0x116/0x130 [72747.567211] ? kthread_park+0x80/0x80 [72747.567214] ret_from_fork+0x1f/0x30 [72747.569686] task:fsstress state:D stack: ---truncated--- CVE-2023-52507:In the Linux kernel, the following vulnerability has been resolved: nfc: nci: assert requested protocol is valid The protocol is used in a bit mask to determine if the protocol is supported. Assert the provided protocol is less than the maximum defined so it doesn't potentially perform a shift-out-of-bounds and provide a clearer error for undefined protocols vs unsupported ones. CVE-2023-52515:In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Do not call scsi_done() from srp_abort() After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call scsi_eh_scmd_add(). Hence, SCSI abort handlers must not call scsi_done(). Otherwise all the above actions would trigger a use-after-free. Hence remove the scsi_done() call from srp_abort(). Keep the srp_free_req() call before returning SUCCESS because we may not see the command again if SUCCESS is returned. CVE-2024-26586:In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix stack corruption When tc filters are first added to a net device, the corresponding local port gets bound to an ACL group in the device. The group contains a list of ACLs. In turn, each ACL points to a different TCAM region where the filters are stored. During forwarding, the ACLs are sequentially evaluated until a match is found. One reason to place filters in different regions is when they are added with decreasing priorities and in an alternating order so that two consecutive filters can never fit in the same region because of their key usage. In Spectrum-2 and newer ASICs the firmware started to report that the maximum number of ACLs in a group is more than 16, but the layout of the register that configures ACL groups (PAGT) was not updated to account for that. It is therefore possible to hit stack corruption [1] in the rare case where more than 16 ACLs in a group are required. Fix by limiting the maximum ACL group size to the minimum between what the firmware reports and the maximum ACLs that fit in the PAGT register. Add a test case to make sure the machine does not crash when this condition is hit. [1] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: mlxsw_sp_acl_tcam_group_update+0x116/0x120 [...] dump_stack_lvl+0x36/0x50 panic+0x305/0x330 __stack_chk_fail+0x15/0x20 mlxsw_sp_acl_tcam_group_update+0x116/0x120 mlxsw_sp_acl_tcam_group_region_attach+0x69/0x110 mlxsw_sp_acl_tcam_vchunk_get+0x492/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b CVE-2021-47076:In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Return CQE error if invalid lkey was supplied RXE is missing update of WQE status in LOCAL_WRITE failures. This caused the following kernel panic if someone sent an atomic operation with an explicitly wrong lkey. [leonro@vm ~]$ mkt test test_atomic_invalid_lkey (tests.test_atomic.AtomicTest) ... WARNING: CPU: 5 PID: 263 at drivers/infiniband/sw/rxe/rxe_comp.c:740 rxe_completer+0x1a6d/0x2e30 [rdma_rxe] Modules linked in: crc32_generic rdma_rxe ip6_udp_tunnel udp_tunnel rdma_ucm rdma_cm ib_umad ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5_core ptp pps_core CPU: 5 PID: 263 Comm: python3 Not tainted 5.13.0-rc1+ #2936 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:rxe_completer+0x1a6d/0x2e30 [rdma_rxe] Code: 03 0f 8e 65 0e 00 00 3b 93 10 06 00 00 0f 84 82 0a 00 00 4c 89 ff 4c 89 44 24 38 e8 2d 74 a9 e1 4c 8b 44 24 38 e9 1c f5 ff ff <0f> 0b e9 0c e8 ff ff b8 05 00 00 00 41 bf 05 00 00 00 e9 ab e7 ff RSP: 0018:ffff8880158af090 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888016a78000 RCX: ffffffffa0cf1652 RDX: 1ffff9200004b442 RSI: 0000000000000004 RDI: ffffc9000025a210 RBP: dffffc0000000000 R08: 00000000ffffffea R09: ffff88801617740b R10: ffffed1002c2ee81 R11: 0000000000000007 R12: ffff88800f3b63e8 R13: ffff888016a78008 R14: ffffc9000025a180 R15: 000000000000000c FS: 00007f88b622a740(0000) GS:ffff88806d540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f88b5a1fa10 CR3: 000000000d848004 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rxe_do_task+0x130/0x230 [rdma_rxe] rxe_rcv+0xb11/0x1df0 [rdma_rxe] rxe_loopback+0x157/0x1e0 [rdma_rxe] rxe_responder+0x5532/0x7620 [rdma_rxe] rxe_do_task+0x130/0x230 [rdma_rxe] rxe_rcv+0x9c8/0x1df0 [rdma_rxe] rxe_loopback+0x157/0x1e0 [rdma_rxe] rxe_requester+0x1efd/0x58c0 [rdma_rxe] rxe_do_task+0x130/0x230 [rdma_rxe] rxe_post_send+0x998/0x1860 [rdma_rxe] ib_uverbs_post_send+0xd5f/0x1220 [ib_uverbs] ib_uverbs_write+0x847/0xc80 [ib_uverbs] vfs_write+0x1c5/0x840 ksys_write+0x176/0x1d0 do_syscall_64+0x3f/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae CVE-2023-52524:In the Linux kernel, the following vulnerability has been resolved: net: nfc: llcp: Add lock when modifying device list The device list needs its associated lock held when modifying it, or the list could become corrupted, as syzbot discovered. CVE-2023-52527:In the Linux kernel, the following vulnerability has been resolved: ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() Including the transhdrlen in length is a problem when the packet is partially filled (e.g. something like send(MSG_MORE) happened previously) when appending to an IPv4 or IPv6 packet as we don't want to repeat the transport header or account for it twice. This can happen under some circumstances, such as splicing into an L2TP socket. The symptom observed is a warning in __ip6_append_data(): WARNING: CPU: 1 PID: 5042 at net/ipv6/ip6_output.c:1800 __ip6_append_data.isra.0+0x1be8/0x47f0 net/ipv6/ip6_output.c:1800 that occurs when MSG_SPLICE_PAGES is used to append more data to an already partially occupied skbuff. The warning occurs when 'copy' is larger than the amount of data in the message iterator. This is because the requested length includes the transport header length when it shouldn't. This can be triggered by, for example: sfd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_L2TP); bind(sfd, ...); // ::1 connect(sfd, ...); // ::1 port 7 send(sfd, buffer, 4100, MSG_MORE); sendfile(sfd, dfd, NULL, 1024); Fix this by only adding transhdrlen into the length if the write queue is empty in l2tp_ip6_sendmsg(), analogously to how UDP does things. l2tp_ip_sendmsg() looks like it won't suffer from this problem as it builds the UDP packet itself. CVE-2023-52445:In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix use after free on context disconnection Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on the context object. However, that might happen before the usb hub_event handler is able to notify the driver. This patch adds a sanity check before the invalid read reported by syzbot, within the context disconnection call stack. CVE-2023-52500:In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command Tags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed when we receive the response. CVE-2023-52528:In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg syzbot reported the following uninit-value access issue: ===================================================== BUG: KMSAN: uninit-value in smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:975 [inline] BUG: KMSAN: uninit-value in smsc75xx_bind+0x5c9/0x11e0 drivers/net/usb/smsc75xx.c:1482 CPU: 0 PID: 8696 Comm: kworker/0:3 Not tainted 5.8.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x21c/0x280 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:975 [inline] smsc75xx_bind+0x5c9/0x11e0 drivers/net/usb/smsc75xx.c:1482 usbnet_probe+0x1152/0x3f90 drivers/net/usb/usbnet.c:1737 usb_probe_interface+0xece/0x1550 drivers/usb/core/driver.c:374 really_probe+0xf20/0x20b0 drivers/base/dd.c:529 driver_probe_device+0x293/0x390 drivers/base/dd.c:701 __device_attach_driver+0x63f/0x830 drivers/base/dd.c:807 bus_for_each_drv+0x2ca/0x3f0 drivers/base/bus.c:431 __device_attach+0x4e2/0x7f0 drivers/base/dd.c:873 device_initial_probe+0x4a/0x60 drivers/base/dd.c:920 bus_probe_device+0x177/0x3d0 drivers/base/bus.c:491 device_add+0x3b0e/0x40d0 drivers/base/core.c:2680 usb_set_configuration+0x380f/0x3f10 drivers/usb/core/message.c:2032 usb_generic_driver_probe+0x138/0x300 drivers/usb/core/generic.c:241 usb_probe_device+0x311/0x490 drivers/usb/core/driver.c:272 really_probe+0xf20/0x20b0 drivers/base/dd.c:529 driver_probe_device+0x293/0x390 drivers/base/dd.c:701 __device_attach_driver+0x63f/0x830 drivers/base/dd.c:807 bus_for_each_drv+0x2ca/0x3f0 drivers/base/bus.c:431 __device_attach+0x4e2/0x7f0 drivers/base/dd.c:873 device_initial_probe+0x4a/0x60 drivers/base/dd.c:920 bus_probe_device+0x177/0x3d0 drivers/base/bus.c:491 device_add+0x3b0e/0x40d0 drivers/base/core.c:2680 usb_new_device+0x1bd4/0x2a30 drivers/usb/core/hub.c:2554 hub_port_connect drivers/usb/core/hub.c:5208 [inline] hub_port_connect_change drivers/usb/core/hub.c:5348 [inline] port_event drivers/usb/core/hub.c:5494 [inline] hub_event+0x5e7b/0x8a70 drivers/usb/core/hub.c:5576 process_one_work+0x1688/0x2140 kernel/workqueue.c:2269 worker_thread+0x10bc/0x2730 kernel/workqueue.c:2415 kthread+0x551/0x590 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293 Local variable ----buf.i87@smsc75xx_bind created at: __smsc75xx_read_reg drivers/net/usb/smsc75xx.c:83 [inline] smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:968 [inline] smsc75xx_bind+0x485/0x11e0 drivers/net/usb/smsc75xx.c:1482 __smsc75xx_read_reg drivers/net/usb/smsc75xx.c:83 [inline] smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:968 [inline] smsc75xx_bind+0x485/0x11e0 drivers/net/usb/smsc75xx.c:1482 This issue is caused because usbnet_read_cmd() reads less bytes than requested (zero byte in the reproducer). In this case, 'buf' is not properly filled. This patch fixes the issue by returning -ENODATA if usbnet_read_cmd() reads less bytes than requested. CVE-2023-52488:In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO The SC16IS7XX IC supports a burst mode to access the FIFOs where the initial register address is sent ($00), followed by all the FIFO data without having to resend the register address each time. In this mode, the IC doesn't increment the register address for each R/W byte. The regmap_raw_read() and regmap_raw_write() are functions which can perform IO over multiple registers. They are currently used to read/write from/to the FIFO, and although they operate correctly in this burst mode on the SPI bus, they would corrupt the regmap cache if it was not disabled manually. The reason is that when the R/W size is more than 1 byte, these functions assume that the register address is incremented and handle the cache accordingly. Convert FIFO R/W functions to use the regmap _noinc_ versions in order to remove the manual cache control which was a workaround when using the _raw_ versions. FIFO registers are properly declared as volatile so cache will not be used/updated for FIFO accesses. CVE-2023-52602:In the Linux kernel, the following vulnerability has been resolved: jfs: fix slab-out-of-bounds Read in dtSearch Currently while searching for current page in the sorted entry table of the page there is a out of bound access. Added a bound check to fix the error. Dave: Set return code to -EIO CVE-2023-52603:In the Linux kernel, the following vulnerability has been resolved: UBSAN: array-index-out-of-bounds in dtSplitRoot Syzkaller reported the following issue: oop0: detected capacity change from 0 to 32768 UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1971:9 index -2 is out of range for type 'struct dtslot [128]' CPU: 0 PID: 3613 Comm: syz-executor270 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_out_of_bounds+0xdb/0x130 lib/ubsan.c:283 dtSplitRoot+0x8d8/0x1900 fs/jfs/jfs_dtree.c:1971 dtSplitUp fs/jfs/jfs_dtree.c:985 [inline] dtInsert+0x1189/0x6b80 fs/jfs/jfs_dtree.c:863 jfs_mkdir+0x757/0xb00 fs/jfs/namei.c:270 vfs_mkdir+0x3b3/0x590 fs/namei.c:4013 do_mkdirat+0x279/0x550 fs/namei.c:4038 __do_sys_mkdirat fs/namei.c:4053 [inline] __se_sys_mkdirat fs/namei.c:4051 [inline] __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4051 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fcdc0113fd9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffeb8bc67d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcdc0113fd9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003 RBP: 00007fcdc00d37a0 R08: 0000000000000000 R09: 00007fcdc00d37a0 R10: 00005555559a72c0 R11: 0000000000000246 R12: 00000000f8008000 R13: 0000000000000000 R14: 00083878000000f8 R15: 0000000000000000 </TASK> The issue is caused when the value of fsi becomes less than -1. The check to break the loop when fsi value becomes -1 is present but syzbot was able to produce value less than -1 which cause the error. This patch simply add the change for the values less than 0. The patch is tested via syzbot. CVE-2023-52593:In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap() Since 'ieee80211_beacon_get()' can return NULL, 'wfx_set_mfp_ap()' should check the return value before examining skb data. So convert the latter to return an appropriate error code and propagate it to return from 'wfx_start_ap()' as well. Compile tested only. CVE-2023-52604:In the Linux kernel, the following vulnerability has been resolved: FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree Syzkaller reported the following issue: UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6 index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]') CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> ================================================================================ Kernel panic - not syncing: UBSAN: panic_on_warn set ... CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 panic+0x30f/0x770 kernel/panic.c:340 check_panic_on_warn+0x82/0xa0 kernel/panic.c:236 ubsan_epilogue lib/ubsan.c:223 [inline] __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> Kernel Offset: disabled Rebooting in 86400 seconds.. The issue is caused when the value of lp becomes greater than CTLTREESIZE which is the max size of stree. Adding a simple check solves this issue. Dave: As the function returns a void, good error handling would require a more intrusive code reorganization, so I modified Osama's patch at use WARN_ON_ONCE for lack of a cleaner option. The patch is tested via syzbot. CVE-2024-26627:In the Linux kernel, the following vulnerability has been resolved: scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler Inside scsi_eh_wakeup(), scsi_host_busy() is called & checked with host lock every time for deciding if error handler kthread needs to be waken up. This can be too heavy in case of recovery, such as: - N hardware queues - queue depth is M for each hardware queue - each scsi_host_busy() iterates over (N * M) tag/requests If recovery is triggered in case that all requests are in-flight, each scsi_eh_wakeup() is strictly serialized, when scsi_eh_wakeup() is called for the last in-flight request, scsi_host_busy() has been run for (N * M - 1) times, and request has been iterated for (N*M - 1) * (N * M) times. If both N and M are big enough, hard lockup can be triggered on acquiring host lock, and it is observed on mpi3mr(128 hw queues, queue depth 8169). Fix the issue by calling scsi_host_busy() outside the host lock. We don't need the host lock for getting busy count because host the lock never covers that. [mkp: Drop unnecessary 'busy' variables pointed out by Bart] CVE-2023-52494:In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Add alignment check for event ring read pointer Though we do check the event ring read pointer by "is_valid_ring_ptr" to make sure it is in the buffer range, but there is another risk the pointer may be not aligned. Since we are expecting event ring elements are 128 bits(struct mhi_ring_element) aligned, an unaligned read pointer could lead to multiple issues like DoS or ring buffer memory corruption. So add a alignment check for event ring read pointer. CVE-2024-26624:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. CVE-2024-26625:In the Linux kernel, the following vulnerability has been resolved: llc: call sock_orphan() at release time syzbot reported an interesting trace [1] caused by a stale sk->sk_wq pointer in a closed llc socket. In commit ff7b11aa481f ("net: socket: set sock->sk to NULL after calling proto_ops::release()") Eric Biggers hinted that some protocols are missing a sock_orphan(), we need to perform a full audit. In net-next, I plan to clear sock->sk from sock_orphan() and amend Eric patch to add a warning. [1] BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:373 [inline] BUG: KASAN: slab-use-after-free in waitqueue_active include/linux/wait.h:127 [inline] BUG: KASAN: slab-use-after-free in sock_def_write_space_wfree net/core/sock.c:3384 [inline] BUG: KASAN: slab-use-after-free in sock_wfree+0x9a8/0x9d0 net/core/sock.c:2468 Read of size 8 at addr ffff88802f4fc880 by task ksoftirqd/1/27 CPU: 1 PID: 27 Comm: ksoftirqd/1 Not tainted 6.8.0-rc1-syzkaller-00049-g6098d87eaf31 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc4/0x620 mm/kasan/report.c:488 kasan_report+0xda/0x110 mm/kasan/report.c:601 list_empty include/linux/list.h:373 [inline] waitqueue_active include/linux/wait.h:127 [inline] sock_def_write_space_wfree net/core/sock.c:3384 [inline] sock_wfree+0x9a8/0x9d0 net/core/sock.c:2468 skb_release_head_state+0xa3/0x2b0 net/core/skbuff.c:1080 skb_release_all net/core/skbuff.c:1092 [inline] napi_consume_skb+0x119/0x2b0 net/core/skbuff.c:1404 e1000_unmap_and_free_tx_resource+0x144/0x200 drivers/net/ethernet/intel/e1000/e1000_main.c:1970 e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3860 [inline] e1000_clean+0x4a1/0x26e0 drivers/net/ethernet/intel/e1000/e1000_main.c:3801 __napi_poll.constprop.0+0xb4/0x540 net/core/dev.c:6576 napi_poll net/core/dev.c:6645 [inline] net_rx_action+0x956/0xe90 net/core/dev.c:6778 __do_softirq+0x21a/0x8de kernel/softirq.c:553 run_ksoftirqd kernel/softirq.c:921 [inline] run_ksoftirqd+0x31/0x60 kernel/softirq.c:913 smpboot_thread_fn+0x660/0xa10 kernel/smpboot.c:164 kthread+0x2c6/0x3a0 kernel/kthread.c:388 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 </TASK> Allocated by task 5167: kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:314 [inline] __kasan_slab_alloc+0x81/0x90 mm/kasan/common.c:340 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3813 [inline] slab_alloc_node mm/slub.c:3860 [inline] kmem_cache_alloc_lru+0x142/0x6f0 mm/slub.c:3879 alloc_inode_sb include/linux/fs.h:3019 [inline] sock_alloc_inode+0x25/0x1c0 net/socket.c:308 alloc_inode+0x5d/0x220 fs/inode.c:260 new_inode_pseudo+0x16/0x80 fs/inode.c:1005 sock_alloc+0x40/0x270 net/socket.c:634 __sock_create+0xbc/0x800 net/socket.c:1535 sock_create net/socket.c:1622 [inline] __sys_socket_create net/socket.c:1659 [inline] __sys_socket+0x14c/0x260 net/socket.c:1706 __do_sys_socket net/socket.c:1720 [inline] __se_sys_socket net/socket.c:1718 [inline] __x64_sys_socket+0x72/0xb0 net/socket.c:1718 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Freed by task 0: kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640 poison_slab_object mm/kasan/common.c:241 [inline] __kasan_slab_free+0x121/0x1b0 mm/kasan/common.c:257 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2121 [inlin ---truncated--- CVE-2023-52502:In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF. Getting a reference on the socket found in a lookup while holding a lock should happen before releasing the lock. nfc_llcp_sock_get_sn() has a similar problem. Finally nfc_llcp_recv_snl() needs to make sure the socket found by nfc_llcp_sock_from_sn() does not disappear. CVE-2024-26622:In the Linux kernel, the following vulnerability has been resolved: tomoyo: fix UAF write bug in tomoyo_write_control() Since tomoyo_write_control() updates head->write_buf when write() of long lines is requested, we need to fetch head->write_buf after head->io_sem is held. Otherwise, concurrent write() requests can cause use-after-free-write and double-free problems. CVE-2023-52599:In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in diNewExt [Syz report] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:2360:2 index -878706688 is out of range for type 'struct iagctl[128]' CPU: 1 PID: 5065 Comm: syz-executor282 Not tainted 6.7.0-rc4-syzkaller-00009-gbee0e7762ad2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 diNewExt+0x3cf3/0x4000 fs/jfs/jfs_imap.c:2360 diAllocExt fs/jfs/jfs_imap.c:1949 [inline] diAllocAG+0xbe8/0x1e50 fs/jfs/jfs_imap.c:1666 diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587 ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56 jfs_mkdir+0x1c5/0xb90 fs/jfs/namei.c:225 vfs_mkdir+0x2f1/0x4b0 fs/namei.c:4106 do_mkdirat+0x264/0x3a0 fs/namei.c:4129 __do_sys_mkdir fs/namei.c:4149 [inline] __se_sys_mkdir fs/namei.c:4147 [inline] __x64_sys_mkdir+0x6e/0x80 fs/namei.c:4147 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7fcb7e6a0b57 Code: ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd83023038 EFLAGS: 00000286 ORIG_RAX: 0000000000000053 RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007fcb7e6a0b57 RDX: 00000000000a1020 RSI: 00000000000001ff RDI: 0000000020000140 RBP: 0000000020000140 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000286 R12: 00007ffd830230d0 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [Analysis] When the agstart is too large, it can cause agno overflow. [Fix] After obtaining agno, if the value is invalid, exit the subsequent process. Modified the test from agno > MAXAG to agno >= MAXAG based on linux-next report by kernel test robot (Dan Carpenter). CVE-2023-52600:In the Linux kernel, the following vulnerability has been resolved: jfs: fix uaf in jfs_evict_inode When the execution of diMount(ipimap) fails, the object ipimap that has been released may be accessed in diFreeSpecial(). Asynchronous ipimap release occurs when rcu_core() calls jfs_free_node(). Therefore, when diMount(ipimap) fails, sbi->ipimap should not be initialized as ipimap. CVE-2023-52622:In the Linux kernel, the following vulnerability has been resolved: ext4: avoid online resizing failures due to oversized flex bg When we online resize an ext4 filesystem with a oversized flexbg_size, mkfs.ext4 -F -G 67108864 $dev -b 4096 100M mount $dev $dir resize2fs $dev 16G the following WARN_ON is triggered: ================================================================== WARNING: CPU: 0 PID: 427 at mm/page_alloc.c:4402 __alloc_pages+0x411/0x550 Modules linked in: sg(E) CPU: 0 PID: 427 Comm: resize2fs Tainted: G E 6.6.0-rc5+ #314 RIP: 0010:__alloc_pages+0x411/0x550 Call Trace: <TASK> __kmalloc_large_node+0xa2/0x200 __kmalloc+0x16e/0x290 ext4_resize_fs+0x481/0xd80 __ext4_ioctl+0x1616/0x1d90 ext4_ioctl+0x12/0x20 __x64_sys_ioctl+0xf0/0x150 do_syscall_64+0x3b/0x90 ================================================================== This is because flexbg_size is too large and the size of the new_group_data array to be allocated exceeds MAX_ORDER. Currently, the minimum value of MAX_ORDER is 8, the minimum value of PAGE_SIZE is 4096, the corresponding maximum number of groups that can be allocated is: (PAGE_SIZE << MAX_ORDER) / sizeof(struct ext4_new_group_data) ≈ 21845 And the value that is down-aligned to the power of 2 is 16384. Therefore, this value is defined as MAX_RESIZE_BG, and the number of groups added each time does not exceed this value during resizing, and is added multiple times to complete the online resizing. The difference is that the metadata in a flex_bg may be more dispersed. CVE-2024-23307:Integer Overflow or Wraparound vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (md, raid, raid5 modules) allows Forced Integer Overflow. CVE-2021-47094:In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Don't advance iterator after restart due to yielding After dropping mmu_lock in the TDP MMU, restart the iterator during tdp_iter_next() and do not advance the iterator. Advancing the iterator results in skipping the top-level SPTE and all its children, which is fatal if any of the skipped SPTEs were not visited before yielding. When zapping all SPTEs, i.e. when min_level == root_level, restarting the iter and then invoking tdp_iter_next() is always fatal if the current gfn has as a valid SPTE, as advancing the iterator results in try_step_side() skipping the current gfn, which wasn't visited before yielding. Sprinkle WARNs on iter->yielded being true in various helpers that are often used in conjunction with yielding, and tag the helper with __must_check to reduce the probabily of improper usage. Failing to zap a top-level SPTE manifests in one of two ways. If a valid SPTE is skipped by both kvm_tdp_mmu_zap_all() and kvm_tdp_mmu_put_root(), the shadow page will be leaked and KVM will WARN accordingly. WARNING: CPU: 1 PID: 3509 at arch/x86/kvm/mmu/tdp_mmu.c:46 [kvm] RIP: 0010:kvm_mmu_uninit_tdp_mmu+0x3e/0x50 [kvm] Call Trace: <TASK> kvm_arch_destroy_vm+0x130/0x1b0 [kvm] kvm_destroy_vm+0x162/0x2a0 [kvm] kvm_vcpu_release+0x34/0x60 [kvm] __fput+0x82/0x240 task_work_run+0x5c/0x90 do_exit+0x364/0xa10 ? futex_unqueue+0x38/0x60 do_group_exit+0x33/0xa0 get_signal+0x155/0x850 arch_do_signal_or_restart+0xed/0x750 exit_to_user_mode_prepare+0xc5/0x120 syscall_exit_to_user_mode+0x1d/0x40 do_syscall_64+0x48/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae If kvm_tdp_mmu_zap_all() skips a gfn/SPTE but that SPTE is then zapped by kvm_tdp_mmu_put_root(), KVM triggers a use-after-free in the form of marking a struct page as dirty/accessed after it has been put back on the free list. This directly triggers a WARN due to encountering a page with page_count() == 0, but it can also lead to data corruption and additional errors in the kernel. WARNING: CPU: 7 PID: 1995658 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:171 RIP: 0010:kvm_is_zone_device_pfn.part.0+0x9e/0xd0 [kvm] Call Trace: <TASK> kvm_set_pfn_dirty+0x120/0x1d0 [kvm] __handle_changed_spte+0x92e/0xca0 [kvm] __handle_changed_spte+0x63c/0xca0 [kvm] __handle_changed_spte+0x63c/0xca0 [kvm] __handle_changed_spte+0x63c/0xca0 [kvm] zap_gfn_range+0x549/0x620 [kvm] kvm_tdp_mmu_put_root+0x1b6/0x270 [kvm] mmu_free_root_page+0x219/0x2c0 [kvm] kvm_mmu_free_roots+0x1b4/0x4e0 [kvm] kvm_mmu_unload+0x1c/0xa0 [kvm] kvm_arch_destroy_vm+0x1f2/0x5c0 [kvm] kvm_put_kvm+0x3b1/0x8b0 [kvm] kvm_vcpu_release+0x4e/0x70 [kvm] __fput+0x1f7/0x8c0 task_work_run+0xf8/0x1a0 do_exit+0x97b/0x2230 do_group_exit+0xda/0x2a0 get_signal+0x3be/0x1e50 arch_do_signal_or_restart+0x244/0x17f0 exit_to_user_mode_prepare+0xcb/0x120 syscall_exit_to_user_mode+0x1d/0x40 do_syscall_64+0x4d/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae Note, the underlying bug existed even before commit 1af4a96025b3 ("KVM: x86/mmu: Yield in TDU MMU iter even if no SPTES changed") moved calls to tdp_mmu_iter_cond_resched() to the beginning of loops, as KVM could still incorrectly advance past a top-level entry when yielding on a lower-level entry. But with respect to leaking shadow pages, the bug was introduced by yielding before processing the current gfn. Alternatively, tdp_mmu_iter_cond_resched() could simply fall through, or callers could jump to their "retry" label. The downside of that approach is that tdp_mmu_iter_cond_resched() _must_ be called before anything else in the loop, and there's no easy way to enfornce that requirement. Ideally, KVM would handling the cond_resched() fully within the iterator macro (the code is actually quite clean) and avoid this entire class of bugs, but that is extremely difficult do wh ---truncated--- CVE-2023-52601:In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in dbAdjTree Currently there is a bound check missing in the dbAdjTree while accessing the dmt_stree. To add the required check added the bool is_ctl which is required to determine the size as suggest in the following commit. https://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e75f4fa@oracle.com/ CVE-2021-46926:In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: intel-sdw-acpi: harden detection of controller The existing code currently sets a pointer to an ACPI handle before checking that it's actually a SoundWire controller. This can lead to issues where the graph walk continues and eventually fails, but the pointer was set already. This patch changes the logic so that the information provided to the caller is set when a controller is found. CVE-2023-52479:In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix uaf in smb20_oplock_break_ack drop reference after use opinfo. CVE-2023-52484:In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range When running an SVA case, the following soft lockup is triggered: -------------------------------------------------------------------- watchdog: BUG: soft lockup - CPU#244 stuck for 26s! pstate: 83400009 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : arm_smmu_cmdq_issue_cmdlist+0x178/0xa50 lr : arm_smmu_cmdq_issue_cmdlist+0x150/0xa50 sp : ffff8000d83ef290 x29: ffff8000d83ef290 x28: 000000003b9aca00 x27: 0000000000000000 x26: ffff8000d83ef3c0 x25: da86c0812194a0e8 x24: 0000000000000000 x23: 0000000000000040 x22: ffff8000d83ef340 x21: ffff0000c63980c0 x20: 0000000000000001 x19: ffff0000c6398080 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: ffff3000b4a3bbb0 x14: ffff3000b4a30888 x13: ffff3000b4a3cf60 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc08120e4d6bc x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000048cfa x5 : 0000000000000000 x4 : 0000000000000001 x3 : 000000000000000a x2 : 0000000080000000 x1 : 0000000000000000 x0 : 0000000000000001 Call trace: arm_smmu_cmdq_issue_cmdlist+0x178/0xa50 __arm_smmu_tlb_inv_range+0x118/0x254 arm_smmu_tlb_inv_range_asid+0x6c/0x130 arm_smmu_mm_invalidate_range+0xa0/0xa4 __mmu_notifier_invalidate_range_end+0x88/0x120 unmap_vmas+0x194/0x1e0 unmap_region+0xb4/0x144 do_mas_align_munmap+0x290/0x490 do_mas_munmap+0xbc/0x124 __vm_munmap+0xa8/0x19c __arm64_sys_munmap+0x28/0x50 invoke_syscall+0x78/0x11c el0_svc_common.constprop.0+0x58/0x1c0 do_el0_svc+0x34/0x60 el0_svc+0x2c/0xd4 el0t_64_sync_handler+0x114/0x140 el0t_64_sync+0x1a4/0x1a8 -------------------------------------------------------------------- Note that since 6.6-rc1 the arm_smmu_mm_invalidate_range above is renamed to "arm_smmu_mm_arch_invalidate_secondary_tlbs", yet the problem remains. The commit 06ff87bae8d3 ("arm64: mm: remove unused functions and variable protoypes") fixed a similar lockup on the CPU MMU side. Yet, it can occur to SMMU too, since arm_smmu_mm_arch_invalidate_secondary_tlbs() is called typically next to MMU tlb flush function, e.g. tlb_flush_mmu_tlbonly { tlb_flush { __flush_tlb_range { // check MAX_TLBI_OPS } } mmu_notifier_arch_invalidate_secondary_tlbs { arm_smmu_mm_arch_invalidate_secondary_tlbs { // does not check MAX_TLBI_OPS } } } Clone a CMDQ_MAX_TLBI_OPS from the MAX_TLBI_OPS in tlbflush.h, since in an SVA case SMMU uses the CPU page table, so it makes sense to align with the tlbflush code. Then, replace per-page TLBI commands with a single per-asid TLBI command, if the request size hits this threshold. CVE-2024-26593:In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Fix block process call transactions According to the Intel datasheets, software must reset the block buffer index twice for block process call transactions: once before writing the outgoing data to the buffer, and once again before reading the incoming data from the buffer. The driver is currently missing the second reset, causing the wrong portion of the block buffer to be read. CVE-2024-26788:In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: init irq after reg initialization Initialize the qDMA irqs after the registers are configured so that interrupts that may have been pending from a primary kernel don't get processed by the irq handler before it is ready to and cause panic with the following trace: Call trace: fsl_qdma_queue_handler+0xf8/0x3e8 __handle_irq_event_percpu+0x78/0x2b0 handle_irq_event_percpu+0x1c/0x68 handle_irq_event+0x44/0x78 handle_fasteoi_irq+0xc8/0x178 generic_handle_irq+0x24/0x38 __handle_domain_irq+0x90/0x100 gic_handle_irq+0x5c/0xb8 el1_irq+0xb8/0x180 _raw_spin_unlock_irqrestore+0x14/0x40 __setup_irq+0x4bc/0x798 request_threaded_irq+0xd8/0x190 devm_request_threaded_irq+0x74/0xe8 fsl_qdma_probe+0x4d4/0xca8 platform_drv_probe+0x50/0xa0 really_probe+0xe0/0x3f8 driver_probe_device+0x64/0x130 device_driver_attach+0x6c/0x78 __driver_attach+0xbc/0x158 bus_for_each_dev+0x5c/0x98 driver_attach+0x20/0x28 bus_add_driver+0x158/0x220 driver_register+0x60/0x110 __platform_driver_register+0x44/0x50 fsl_qdma_driver_init+0x18/0x20 do_one_initcall+0x48/0x258 kernel_init_freeable+0x1a4/0x23c kernel_init+0x10/0xf8 ret_from_fork+0x10/0x18 CVE-2024-26607:In the Linux kernel, the following vulnerability has been resolved: drm/bridge: sii902x: Fix probing race issue A null pointer dereference crash has been observed rarely on TI platforms using sii9022 bridge: [ 53.271356] sii902x_get_edid+0x34/0x70 [sii902x] [ 53.276066] sii902x_bridge_get_edid+0x14/0x20 [sii902x] [ 53.281381] drm_bridge_get_edid+0x20/0x34 [drm] [ 53.286305] drm_bridge_connector_get_modes+0x8c/0xcc [drm_kms_helper] [ 53.292955] drm_helper_probe_single_connector_modes+0x190/0x538 [drm_kms_helper] [ 53.300510] drm_client_modeset_probe+0x1f0/0xbd4 [drm] [ 53.305958] __drm_fb_helper_initial_config_and_unlock+0x50/0x510 [drm_kms_helper] [ 53.313611] drm_fb_helper_initial_config+0x48/0x58 [drm_kms_helper] [ 53.320039] drm_fbdev_dma_client_hotplug+0x84/0xd4 [drm_dma_helper] [ 53.326401] drm_client_register+0x5c/0xa0 [drm] [ 53.331216] drm_fbdev_dma_setup+0xc8/0x13c [drm_dma_helper] [ 53.336881] tidss_probe+0x128/0x264 [tidss] [ 53.341174] platform_probe+0x68/0xc4 [ 53.344841] really_probe+0x188/0x3c4 [ 53.348501] __driver_probe_device+0x7c/0x16c [ 53.352854] driver_probe_device+0x3c/0x10c [ 53.357033] __device_attach_driver+0xbc/0x158 [ 53.361472] bus_for_each_drv+0x88/0xe8 [ 53.365303] __device_attach+0xa0/0x1b4 [ 53.369135] device_initial_probe+0x14/0x20 [ 53.373314] bus_probe_device+0xb0/0xb4 [ 53.377145] deferred_probe_work_func+0xcc/0x124 [ 53.381757] process_one_work+0x1f0/0x518 [ 53.385770] worker_thread+0x1e8/0x3dc [ 53.389519] kthread+0x11c/0x120 [ 53.392750] ret_from_fork+0x10/0x20 The issue here is as follows: - tidss probes, but is deferred as sii902x is still missing. - sii902x starts probing and enters sii902x_init(). - sii902x calls drm_bridge_add(). Now the sii902x bridge is ready from DRM's perspective. - sii902x calls sii902x_audio_codec_init() and platform_device_register_data() - The registration of the audio platform device causes probing of the deferred devices. - tidss probes, which eventually causes sii902x_bridge_get_edid() to be called. - sii902x_bridge_get_edid() tries to use the i2c to read the edid. However, the sii902x driver has not set up the i2c part yet, leading to the crash. Fix this by moving the drm_bridge_add() to the end of the sii902x_init(), which is also at the very end of sii902x_probe(). CVE-2024-26773:In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() Determine if the group block bitmap is corrupted before using ac_b_ex in ext4_mb_try_best_found() to avoid allocating blocks from a group with a corrupted block bitmap in the following concurrency and making the situation worse. ext4_mb_regular_allocator ext4_lock_group(sb, group) ext4_mb_good_group // check if the group bbitmap is corrupted ext4_mb_complex_scan_group // Scan group gets ac_b_ex but doesn't use it ext4_unlock_group(sb, group) ext4_mark_group_bitmap_corrupted(group) // The block bitmap was corrupted during // the group unlock gap. ext4_mb_try_best_found ext4_lock_group(ac->ac_sb, group) ext4_mb_use_best_found mb_mark_used // Allocating blocks in block bitmap corrupted group CVE-2023-52469:In the Linux kernel, the following vulnerability has been resolved: drivers/amd/pm: fix a use-after-free in kv_parse_power_table When ps allocated by kzalloc equals to NULL, kv_parse_power_table frees adev->pm.dpm.ps that allocated before. However, after the control flow goes through the following call chains: kv_parse_power_table |-> kv_dpm_init |-> kv_dpm_sw_init |-> kv_dpm_fini The adev->pm.dpm.ps is used in the for loop of kv_dpm_fini after its first free in kv_parse_power_table and causes a use-after-free bug. CVE-2023-52475:In the Linux kernel, the following vulnerability has been resolved: Input: powermate - fix use-after-free in powermate_config_complete syzbot has found a use-after-free bug [1] in the powermate driver. This happens when the device is disconnected, which leads to a memory free from the powermate_device struct. When an asynchronous control message completes after the kfree and its callback is invoked, the lock does not exist anymore and hence the bug. Use usb_kill_urb() on pm->config to cancel any in-progress requests upon device disconnection. [1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e CVE-2024-26600:In the Linux kernel, the following vulnerability has been resolved: phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP If the external phy working together with phy-omap-usb2 does not implement send_srp(), we may still attempt to call it. This can happen on an idle Ethernet gadget triggering a wakeup for example: configfs-gadget.g1 gadget.0: ECM Suspend configfs-gadget.g1 gadget.0: Port suspended. Triggering wakeup ... Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute ... PC is at 0x0 LR is at musb_gadget_wakeup+0x1d4/0x254 [musb_hdrc] ... musb_gadget_wakeup [musb_hdrc] from usb_gadget_wakeup+0x1c/0x3c [udc_core] usb_gadget_wakeup [udc_core] from eth_start_xmit+0x3b0/0x3d4 [u_ether] eth_start_xmit [u_ether] from dev_hard_start_xmit+0x94/0x24c dev_hard_start_xmit from sch_direct_xmit+0x104/0x2e4 sch_direct_xmit from __dev_queue_xmit+0x334/0xd88 __dev_queue_xmit from arp_solicit+0xf0/0x268 arp_solicit from neigh_probe+0x54/0x7c neigh_probe from __neigh_event_send+0x22c/0x47c __neigh_event_send from neigh_resolve_output+0x14c/0x1c0 neigh_resolve_output from ip_finish_output2+0x1c8/0x628 ip_finish_output2 from ip_send_skb+0x40/0xd8 ip_send_skb from udp_send_skb+0x124/0x340 udp_send_skb from udp_sendmsg+0x780/0x984 udp_sendmsg from __sys_sendto+0xd8/0x158 __sys_sendto from ret_fast_syscall+0x0/0x58 Let's fix the issue by checking for send_srp() and set_vbus() before calling them. For USB peripheral only cases these both could be NULL. CVE-2021-47037:In the Linux kernel, the following vulnerability has been resolved: ASoC: q6afe-clocks: fix reprobing of the driver Q6afe-clocks driver can get reprobed. For example if the APR services are restarted after the firmware crash. However currently Q6afe-clocks driver will oops because hw.init will get cleared during first _probe call. Rewrite the driver to fill the clock data at runtime rather than using big static array of clocks. CVE-2023-52456:In the Linux kernel, the following vulnerability has been resolved: serial: imx: fix tx statemachine deadlock When using the serial port as RS485 port, the tx statemachine is used to control the RTS pin to drive the RS485 transceiver TX_EN pin. When the TTY port is closed in the middle of a transmission (for instance during userland application crash), imx_uart_shutdown disables the interface and disables the Transmission Complete interrupt. afer that, imx_uart_stop_tx bails on an incomplete transmission, to be retriggered by the TC interrupt. This interrupt is disabled and therefore the tx statemachine never transitions out of SEND. The statemachine is in deadlock now, and the TX_EN remains low, making the interface useless. imx_uart_stop_tx now checks for incomplete transmission AND whether TC interrupts are enabled before bailing to be retriggered. This makes sure the state machine handling is reached, and is properly set to WAIT_AFTER_SEND. CVE-2024-26696:In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() Syzbot reported a hang issue in migrate_pages_batch() called by mbind() and nilfs_lookup_dirty_data_buffers() called in the log writer of nilfs2. While migrate_pages_batch() locks a folio and waits for the writeback to complete, the log writer thread that should bring the writeback to completion picks up the folio being written back in nilfs_lookup_dirty_data_buffers() that it calls for subsequent log creation and was trying to lock the folio. Thus causing a deadlock. In the first place, it is unexpected that folios/pages in the middle of writeback will be updated and become dirty. Nilfs2 adds a checksum to verify the validity of the log being written and uses it for recovery at mount, so data changes during writeback are suppressed. Since this is broken, an unclean shutdown could potentially cause recovery to fail. Investigation revealed that the root cause is that the wait for writeback completion in nilfs_page_mkwrite() is conditional, and if the backing device does not require stable writes, data may be modified without waiting. Fix these issues by making nilfs_page_mkwrite() wait for writeback to finish regardless of the stable write requirement of the backing device. CVE-2023-52467:In the Linux kernel, the following vulnerability has been resolved: mfd: syscon: Fix null pointer dereference in of_syscon_register() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. CVE-2024-26608:In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix global oob in ksmbd_nl_policy Similar to a reported issue (check the commit b33fb5b801c6 ("net: qualcomm: rmnet: fix global oob in rmnet_policy"), my local fuzzer finds another global out-of-bounds read for policy ksmbd_nl_policy. See bug trace below: ================================================================== BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline] BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 Read of size 1 at addr ffffffff8f24b100 by task syz-executor.1/62810 CPU: 0 PID: 62810 Comm: syz-executor.1 Tainted: G N 6.1.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x172/0x475 mm/kasan/report.c:395 kasan_report+0xbb/0x1c0 mm/kasan/report.c:495 validate_nla lib/nlattr.c:386 [inline] __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 __nla_parse+0x3e/0x50 lib/nlattr.c:697 __nlmsg_parse include/net/netlink.h:748 [inline] genl_family_rcv_msg_attrs_parse.constprop.0+0x1b0/0x290 net/netlink/genetlink.c:565 genl_family_rcv_msg_doit+0xda/0x330 net/netlink/genetlink.c:734 genl_family_rcv_msg net/netlink/genetlink.c:833 [inline] genl_rcv_msg+0x441/0x780 net/netlink/genetlink.c:850 netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540 genl_rcv+0x24/0x40 net/netlink/genetlink.c:861 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0x154/0x190 net/socket.c:734 ____sys_sendmsg+0x6df/0x840 net/socket.c:2482 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fdd66a8f359 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fdd65e00168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fdd66bbcf80 RCX: 00007fdd66a8f359 RDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000003 RBP: 00007fdd66ada493 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc84b81aff R14: 00007fdd65e00300 R15: 0000000000022000 </TASK> The buggy address belongs to the variable: ksmbd_nl_policy+0x100/0xa80 The buggy address belongs to the physical page: page:0000000034f47940 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1ccc4b flags: 0x200000000001000(reserved|node=0|zone=2) raw: 0200000000001000 ffffea00073312c8 ffffea00073312c8 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffffff8f24b000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffffff8f24b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffffff8f24b100: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 07 f9 ^ ffffffff8f24b180: f9 f9 f9 f9 00 05 f9 f9 f9 f9 f9 f9 00 00 00 05 ffffffff8f24b200: f9 f9 f9 f9 00 00 03 f9 f9 f9 f9 f9 00 00 04 f9 ================================================================== To fix it, add a placeholder named __KSMBD_EVENT_MAX and let KSMBD_EVENT_MAX to be its original value - 1 according to what other netlink families do. Also change two sites that refer the KSMBD_EVENT_MAX to correct value. CVE-2024-26589:In the Linux kernel, the following vulnerability has been resolved: bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS For PTR_TO_FLOW_KEYS, check_flow_keys_access() only uses fixed off for validation. However, variable offset ptr alu is not prohibited for this ptr kind. So the variable offset is not checked. The following prog is accepted: func#0 @0 0: R1=ctx() R10=fp0 0: (bf) r6 = r1 ; R1=ctx() R6_w=ctx() 1: (79) r7 = *(u64 *)(r6 +144) ; R6_w=ctx() R7_w=flow_keys() 2: (b7) r8 = 1024 ; R8_w=1024 3: (37) r8 /= 1 ; R8_w=scalar() 4: (57) r8 &= 1024 ; R8_w=scalar(smin=smin32=0, smax=umax=smax32=umax32=1024,var_off=(0x0; 0x400)) 5: (0f) r7 += r8 mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1 mark_precise: frame0: regs=r8 stack= before 4: (57) r8 &= 1024 mark_precise: frame0: regs=r8 stack= before 3: (37) r8 /= 1 mark_precise: frame0: regs=r8 stack= before 2: (b7) r8 = 1024 6: R7_w=flow_keys(smin=smin32=0,smax=umax=smax32=umax32=1024,var_off =(0x0; 0x400)) R8_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=1024, var_off=(0x0; 0x400)) 6: (79) r0 = *(u64 *)(r7 +0) ; R0_w=scalar() 7: (95) exit This prog loads flow_keys to r7, and adds the variable offset r8 to r7, and finally causes out-of-bounds access: BUG: unable to handle page fault for address: ffffc90014c80038 [...] Call Trace: <TASK> bpf_dispatcher_nop_func include/linux/bpf.h:1231 [inline] __bpf_prog_run include/linux/filter.h:651 [inline] bpf_prog_run include/linux/filter.h:658 [inline] bpf_prog_run_pin_on_cpu include/linux/filter.h:675 [inline] bpf_flow_dissect+0x15f/0x350 net/core/flow_dissector.c:991 bpf_prog_test_run_flow_dissector+0x39d/0x620 net/bpf/test_run.c:1359 bpf_prog_test_run kernel/bpf/syscall.c:4107 [inline] __sys_bpf+0xf8f/0x4560 kernel/bpf/syscall.c:5475 __do_sys_bpf kernel/bpf/syscall.c:5561 [inline] __se_sys_bpf kernel/bpf/syscall.c:5559 [inline] __x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:5559 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fix this by rejecting ptr alu with variable offset on flow_keys. Applying the patch rejects the program with "R7 pointer arithmetic on flow_keys prohibited". CVE-2024-26597:In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix global oob in rmnet_policy The variable rmnet_link_ops assign a *bigger* maxtype which leads to a global out-of-bounds read when parsing the netlink attributes. See bug trace below: ================================================================== BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline] BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 Read of size 1 at addr ffffffff92c438d0 by task syz-executor.6/84207 CPU: 0 PID: 84207 Comm: syz-executor.6 Tainted: G N 6.1.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x172/0x475 mm/kasan/report.c:395 kasan_report+0xbb/0x1c0 mm/kasan/report.c:495 validate_nla lib/nlattr.c:386 [inline] __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 __nla_parse+0x3e/0x50 lib/nlattr.c:697 nla_parse_nested_deprecated include/net/netlink.h:1248 [inline] __rtnl_newlink+0x50a/0x1880 net/core/rtnetlink.c:3485 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3594 rtnetlink_rcv_msg+0x43c/0xd70 net/core/rtnetlink.c:6091 netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0x154/0x190 net/socket.c:734 ____sys_sendmsg+0x6df/0x840 net/socket.c:2482 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fdcf2072359 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fdcf13e3168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fdcf219ff80 RCX: 00007fdcf2072359 RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003 RBP: 00007fdcf20bd493 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffbb8d7bdf R14: 00007fdcf13e3300 R15: 0000000000022000 </TASK> The buggy address belongs to the variable: rmnet_policy+0x30/0xe0 The buggy address belongs to the physical page: page:0000000065bdeb3c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x155243 flags: 0x200000000001000(reserved|node=0|zone=2) raw: 0200000000001000 ffffea00055490c8 ffffea00055490c8 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffffff92c43780: f9 f9 f9 f9 00 00 00 02 f9 f9 f9 f9 00 00 00 07 ffffffff92c43800: f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 06 f9 f9 f9 >ffffffff92c43880: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 ^ ffffffff92c43900: 00 00 00 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9 f9 ffffffff92c43980: 00 00 00 07 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 According to the comment of `nla_parse_nested_deprecated`, the maxtype should be len(destination array) - 1. Hence use `IFLA_RMNET_MAX` here. CVE-2024-26606:In the Linux kernel, the following vulnerability has been resolved: binder: signal epoll threads of self-work In (e)poll mode, threads often depend on I/O events to determine when data is ready for consumption. Within binder, a thread may initiate a command via BINDER_WRITE_READ without a read buffer and then make use of epoll_wait() or similar to consume any responses afterwards. It is then crucial that epoll threads are signaled via wakeup when they queue their own work. Otherwise, they risk waiting indefinitely for an event leaving their work unhandled. What is worse, subsequent commands won't trigger a wakeup either as the thread has pending work. CVE-2023-52477:In the Linux kernel, the following vulnerability has been resolved: usb: hub: Guard against accesses to uninitialized BOS descriptors Many functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h access fields inside udev->bos without checking if it was allocated and initialized. If usb_get_bos_descriptor() fails for whatever reason, udev->bos will be NULL and those accesses will result in a crash: BUG: kernel NULL pointer dereference, address: 0000000000000018 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 5 PID: 17818 Comm: kworker/5:1 Tainted: G W 5.15.108-18910-gab0e1cb584e1 #1 <HASH:1f9e 1> Hardware name: Google Kindred/Kindred, BIOS Google_Kindred.12672.413.0 02/03/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:hub_port_reset+0x193/0x788 Code: 89 f7 e8 20 f7 15 00 48 8b 43 08 80 b8 96 03 00 00 03 75 36 0f b7 88 92 03 00 00 81 f9 10 03 00 00 72 27 48 8b 80 a8 03 00 00 <48> 83 78 18 00 74 19 48 89 df 48 8b 75 b0 ba 02 00 00 00 4c 89 e9 RSP: 0018:ffffab740c53fcf8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffa1bc5f678000 RCX: 0000000000000310 RDX: fffffffffffffdff RSI: 0000000000000286 RDI: ffffa1be9655b840 RBP: ffffab740c53fd70 R08: 00001b7d5edaa20c R09: ffffffffb005e060 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: ffffab740c53fd3e R14: 0000000000000032 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffffa1be96540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 000000022e80c005 CR4: 00000000003706e0 Call Trace: hub_event+0x73f/0x156e ? hub_activate+0x5b7/0x68f process_one_work+0x1a2/0x487 worker_thread+0x11a/0x288 kthread+0x13a/0x152 ? process_one_work+0x487/0x487 ? kthread_associate_blkcg+0x70/0x70 ret_from_fork+0x1f/0x30 Fall back to a default behavior if the BOS descriptor isn't accessible and skip all the functionalities that depend on it: LPM support checks, Super Speed capabilitiy checks, U1/U2 states setup. CVE-2023-52454:In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length If the host sends an H2CData command with an invalid DATAL, the kernel may crash in nvmet_tcp_build_pdu_iovec(). Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 lr : nvmet_tcp_io_work+0x6ac/0x718 [nvmet_tcp] Call trace: process_one_work+0x174/0x3c8 worker_thread+0x2d0/0x3e8 kthread+0x104/0x110 Fix the bug by raising a fatal error if DATAL isn't coherent with the packet size. Also, the PDU length should never exceed the MAXH2CDATA parameter which has been communicated to the host in nvmet_tcp_handle_icreq(). CVE-2023-52476:In the Linux kernel, the following vulnerability has been resolved: perf/x86/lbr: Filter vsyscall addresses We found that a panic can occur when a vsyscall is made while LBR sampling is active. If the vsyscall is interrupted (NMI) for perf sampling, this call sequence can occur (most recent at top): __insn_get_emulate_prefix() insn_get_emulate_prefix() insn_get_prefixes() insn_get_opcode() decode_branch_type() get_branch_type() intel_pmu_lbr_filter() intel_pmu_handle_irq() perf_event_nmi_handler() Within __insn_get_emulate_prefix() at frame 0, a macro is called: peek_nbyte_next(insn_byte_t, insn, i) Within this macro, this dereference occurs: (insn)->next_byte Inspecting registers at this point, the value of the next_byte field is the address of the vsyscall made, for example the location of the vsyscall version of gettimeofday() at 0xffffffffff600000. The access to an address in the vsyscall region will trigger an oops due to an unhandled page fault. To fix the bug, filtering for vsyscalls can be done when determining the branch type. This patch will return a "none" branch if a kernel address if found to lie in the vsyscall region. CVE-2024-26654:In the Linux kernel, the following vulnerability has been resolved: ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs The dreamcastcard->timer could schedule the spu_dma_work and the spu_dma_work could also arm the dreamcastcard->timer. When the snd_pcm_substream is closing, the aica_channel will be deallocated. But it could still be dereferenced in the worker thread. The reason is that del_timer() will return directly regardless of whether the timer handler is running or not and the worker could be rescheduled in the timer handler. As a result, the UAF bug will happen. The racy situation is shown below: (Thread 1) | (Thread 2) snd_aicapcm_pcm_close() | ... | run_spu_dma() //worker | mod_timer() flush_work() | del_timer() | aica_period_elapsed() //timer kfree(dreamcastcard->channel) | schedule_work() | run_spu_dma() //worker ... | dreamcastcard->channel-> //USE In order to mitigate this bug and other possible corner cases, call mod_timer() conditionally in run_spu_dma(), then implement PCM sync_stop op to cancel both the timer and worker. The sync_stop op will be called from PCM core appropriately when needed. CVE-2024-26603:In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Stop relying on userspace for info to fault in xsave buffer Before this change, the expected size of the user space buffer was taken from fx_sw->xstate_size. fx_sw->xstate_size can be changed from user-space, so it is possible construct a sigreturn frame where: * fx_sw->xstate_size is smaller than the size required by valid bits in fx_sw->xfeatures. * user-space unmaps parts of the sigrame fpu buffer so that not all of the buffer required by xrstor is accessible. In this case, xrstor tries to restore and accesses the unmapped area which results in a fault. But fault_in_readable succeeds because buf + fx_sw->xstate_size is within the still mapped area, so it goes back and tries xrstor again. It will spin in this loop forever. Instead, fault in the maximum size which can be touched by XRSTOR (taken from fpstate->user_size). [ dhansen: tweak subject / changelog ] CVE-2024-26644:In the Linux kernel, the following vulnerability has been resolved: btrfs: don't abort filesystem when attempting to snapshot deleted subvolume If the source file descriptor to the snapshot ioctl refers to a deleted subvolume, we get the following abort: BTRFS: Transaction aborted (error -2) WARNING: CPU: 0 PID: 833 at fs/btrfs/transaction.c:1875 create_pending_snapshot+0x1040/0x1190 [btrfs] Modules linked in: pata_acpi btrfs ata_piix libata scsi_mod virtio_net blake2b_generic xor net_failover virtio_rng failover scsi_common rng_core raid6_pq libcrc32c CPU: 0 PID: 833 Comm: t_snapshot_dele Not tainted 6.7.0-rc6 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014 RIP: 0010:create_pending_snapshot+0x1040/0x1190 [btrfs] RSP: 0018:ffffa09c01337af8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9982053e7c78 RCX: 0000000000000027 RDX: ffff99827dc20848 RSI: 0000000000000001 RDI: ffff99827dc20840 RBP: ffffa09c01337c00 R08: 0000000000000000 R09: ffffa09c01337998 R10: 0000000000000003 R11: ffffffffb96da248 R12: fffffffffffffffe R13: ffff99820535bb28 R14: ffff99820b7bd000 R15: ffff99820381ea80 FS: 00007fe20aadabc0(0000) GS:ffff99827dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000559a120b502f CR3: 00000000055b6000 CR4: 00000000000006f0 Call Trace: <TASK> ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? __warn+0x81/0x130 ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? report_bug+0x171/0x1a0 ? handle_bug+0x3a/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? create_pending_snapshot+0x1040/0x1190 [btrfs] create_pending_snapshots+0x92/0xc0 [btrfs] btrfs_commit_transaction+0x66b/0xf40 [btrfs] btrfs_mksubvol+0x301/0x4d0 [btrfs] btrfs_mksnapshot+0x80/0xb0 [btrfs] __btrfs_ioctl_snap_create+0x1c2/0x1d0 [btrfs] btrfs_ioctl_snap_create_v2+0xc4/0x150 [btrfs] btrfs_ioctl+0x8a6/0x2650 [btrfs] ? kmem_cache_free+0x22/0x340 ? do_sys_openat2+0x97/0xe0 __x64_sys_ioctl+0x97/0xd0 do_syscall_64+0x46/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 RIP: 0033:0x7fe20abe83af RSP: 002b:00007ffe6eff1360 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fe20abe83af RDX: 00007ffe6eff23c0 RSI: 0000000050009417 RDI: 0000000000000003 RBP: 0000000000000003 R08: 0000000000000000 R09: 00007fe20ad16cd0 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe6eff13c0 R14: 00007fe20ad45000 R15: 0000559a120b6d58 </TASK> ---[ end trace 0000000000000000 ]--- BTRFS: error (device vdc: state A) in create_pending_snapshot:1875: errno=-2 No such entry BTRFS info (device vdc: state EA): forced readonly BTRFS warning (device vdc: state EA): Skipping commit of aborted transaction. BTRFS: error (device vdc: state EA) in cleanup_transaction:2055: errno=-2 No such entry This happens because create_pending_snapshot() initializes the new root item as a copy of the source root item. This includes the refs field, which is 0 for a deleted subvolume. The call to btrfs_insert_root() therefore inserts a root with refs == 0. btrfs_get_new_fs_root() then finds the root and returns -ENOENT if refs == 0, which causes create_pending_snapshot() to abort. Fix it by checking the source root's refs before attempting the snapshot, but after locking subvol_sem to avoid racing with deletion. CVE-2022-2639:An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system. FusionOS kernel-5.10.0-136.71.0.151.u109.fos23.x86_64.rpm kernel-headers-5.10.0-136.71.0.151.u109.fos23.x86_64.rpm kernel-devel-5.10.0-136.71.0.151.u109.fos23.x86_64.rpm kernel-tools-5.10.0-136.71.0.151.u109.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.71.0.151.u109.fos23.x86_64.rpm perf-5.10.0-136.71.0.151.u109.fos23.x86_64.rpm python3-perf-5.10.0-136.71.0.151.u109.fos23.x86_64.rpm bpftool-5.10.0-136.71.0.151.u109.fos23.x86_64.rpm kernel-5.10.0-136.71.0.151.u109.fos23.aarch64.rpm kernel-headers-5.10.0-136.71.0.151.u109.fos23.aarch64.rpm kernel-devel-5.10.0-136.71.0.151.u109.fos23.aarch64.rpm kernel-tools-5.10.0-136.71.0.151.u109.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.71.0.151.u109.fos23.aarch64.rpm perf-5.10.0-136.71.0.151.u109.fos23.aarch64.rpm python3-perf-5.10.0-136.71.0.151.u109.fos23.aarch64.rpm bpftool-5.10.0-136.71.0.151.u109.fos23.aarch64.rpm FusionOS-SA-2024-2129 Important FusionOS CVE-2024-32487:less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases. FusionOS less-590-6.u3.fos23.x86_64.rpm less-help-590-6.u3.fos23.noarch.rpm less-590-6.u3.fos23.aarch64.rpm FusionOS-SA-2024-2130 Important FusionOS CVE-2024-2002:A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try to dealloc(free) an allocation twice, potentially causing unpredictable and various results. FusionOS libdwarf-0.9.1-1.fos23.x86_64.rpm libdwarf-devel-0.9.1-1.fos23.x86_64.rpm libdwarf-tools-0.9.1-1.fos23.x86_64.rpm libdwarf-help-0.9.1-1.fos23.noarch.rpm libdwarf-0.9.1-1.fos23.aarch64.rpm libdwarf-devel-0.9.1-1.fos23.aarch64.rpm libdwarf-tools-0.9.1-1.fos23.aarch64.rpm FusionOS-SA-2024-2131 Moderate FusionOS CVE-2024-2357:The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use PreSharedKeys (authby=secret) and the connection cannot find a matching configured secret. When such a connection is automatically added on startup using the auto= keyword, it can cause repeated crashes leading to a Denial of Service. FusionOS libreswan-4.14-1.u1.fos23.x86_64.rpm libreswan-help-4.14-1.u1.fos23.x86_64.rpm libreswan-4.14-1.u1.fos23.aarch64.rpm libreswan-help-4.14-1.u1.fos23.aarch64.rpm FusionOS-SA-2024-2132 Moderate FusionOS CVE-2024-1441:An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash. CVE-2024-2494:A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a crash due to the negative length being treated as a huge positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by causing the libvirt daemon to crash. CVE-2024-2496:A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash. FusionOS libvirt-6.2.0-63.u9.fos23.x86_64.rpm libvirt-docs-6.2.0-63.u9.fos23.x86_64.rpm libvirt-daemon-6.2.0-63.u9.fos23.x86_64.rpm libvirt-daemon-config-network-6.2.0-63.u9.fos23.x86_64.rpm libvirt-daemon-config-nwfilter-6.2.0-63.u9.fos23.x86_64.rpm libvirt-daemon-driver-network-6.2.0-63.u9.fos23.x86_64.rpm libvirt-daemon-driver-nwfilter-6.2.0-63.u9.fos23.x86_64.rpm libvirt-daemon-driver-nodedev-6.2.0-63.u9.fos23.x86_64.rpm libvirt-daemon-driver-interface-6.2.0-63.u9.fos23.x86_64.rpm libvirt-daemon-driver-secret-6.2.0-63.u9.fos23.x86_64.rpm libvirt-daemon-driver-storage-core-6.2.0-63.u9.fos23.x86_64.rpm libvirt-daemon-driver-storage-logical-6.2.0-63.u9.fos23.x86_64.rpm libvirt-daemon-driver-storage-disk-6.2.0-63.u9.fos23.x86_64.rpm libvirt-daemon-driver-storage-scsi-6.2.0-63.u9.fos23.x86_64.rpm libvirt-daemon-driver-storage-iscsi-6.2.0-63.u9.fos23.x86_64.rpm libvirt-daemon-driver-storage-iscsi-direct-6.2.0-63.u9.fos23.x86_64.rpm libvirt-daemon-driver-storage-mpath-6.2.0-63.u9.fos23.x86_64.rpm libvirt-daemon-driver-storage-gluster-6.2.0-63.u9.fos23.x86_64.rpm libvirt-daemon-driver-storage-rbd-6.2.0-63.u9.fos23.x86_64.rpm libvirt-daemon-driver-storage-6.2.0-63.u9.fos23.x86_64.rpm libvirt-daemon-driver-qemu-6.2.0-63.u9.fos23.x86_64.rpm libvirt-daemon-qemu-6.2.0-63.u9.fos23.x86_64.rpm libvirt-daemon-kvm-6.2.0-63.u9.fos23.x86_64.rpm libvirt-client-6.2.0-63.u9.fos23.x86_64.rpm libvirt-libs-6.2.0-63.u9.fos23.x86_64.rpm libvirt-admin-6.2.0-63.u9.fos23.x86_64.rpm libvirt-bash-completion-6.2.0-63.u9.fos23.x86_64.rpm libvirt-wireshark-6.2.0-63.u9.fos23.x86_64.rpm libvirt-devel-6.2.0-63.u9.fos23.x86_64.rpm libvirt-lock-sanlock-6.2.0-63.u9.fos23.x86_64.rpm libvirt-nss-6.2.0-63.u9.fos23.x86_64.rpm libvirt-6.2.0-63.u9.fos23.aarch64.rpm libvirt-docs-6.2.0-63.u9.fos23.aarch64.rpm libvirt-daemon-6.2.0-63.u9.fos23.aarch64.rpm libvirt-daemon-config-network-6.2.0-63.u9.fos23.aarch64.rpm libvirt-daemon-config-nwfilter-6.2.0-63.u9.fos23.aarch64.rpm libvirt-daemon-driver-network-6.2.0-63.u9.fos23.aarch64.rpm libvirt-daemon-driver-nwfilter-6.2.0-63.u9.fos23.aarch64.rpm libvirt-daemon-driver-nodedev-6.2.0-63.u9.fos23.aarch64.rpm libvirt-daemon-driver-interface-6.2.0-63.u9.fos23.aarch64.rpm libvirt-daemon-driver-secret-6.2.0-63.u9.fos23.aarch64.rpm libvirt-daemon-driver-storage-core-6.2.0-63.u9.fos23.aarch64.rpm libvirt-daemon-driver-storage-logical-6.2.0-63.u9.fos23.aarch64.rpm libvirt-daemon-driver-storage-disk-6.2.0-63.u9.fos23.aarch64.rpm libvirt-daemon-driver-storage-scsi-6.2.0-63.u9.fos23.aarch64.rpm libvirt-daemon-driver-storage-iscsi-6.2.0-63.u9.fos23.aarch64.rpm libvirt-daemon-driver-storage-iscsi-direct-6.2.0-63.u9.fos23.aarch64.rpm libvirt-daemon-driver-storage-mpath-6.2.0-63.u9.fos23.aarch64.rpm libvirt-daemon-driver-storage-gluster-6.2.0-63.u9.fos23.aarch64.rpm libvirt-daemon-driver-storage-rbd-6.2.0-63.u9.fos23.aarch64.rpm libvirt-daemon-driver-storage-6.2.0-63.u9.fos23.aarch64.rpm libvirt-daemon-driver-qemu-6.2.0-63.u9.fos23.aarch64.rpm libvirt-daemon-qemu-6.2.0-63.u9.fos23.aarch64.rpm libvirt-daemon-kvm-6.2.0-63.u9.fos23.aarch64.rpm libvirt-client-6.2.0-63.u9.fos23.aarch64.rpm libvirt-libs-6.2.0-63.u9.fos23.aarch64.rpm libvirt-admin-6.2.0-63.u9.fos23.aarch64.rpm libvirt-bash-completion-6.2.0-63.u9.fos23.aarch64.rpm libvirt-wireshark-6.2.0-63.u9.fos23.aarch64.rpm libvirt-devel-6.2.0-63.u9.fos23.aarch64.rpm libvirt-lock-sanlock-6.2.0-63.u9.fos23.aarch64.rpm libvirt-nss-6.2.0-63.u9.fos23.aarch64.rpm FusionOS-SA-2024-2133 Low FusionOS CVE-2023-46049:LLVM 15.0.0 has a NULL pointer dereference in the parseOneMetadata() function via a crafted pdflatex.fmt file (or perhaps a crafted .o file) to llvm-lto. NOTE: this is disputed because the relationship between pdflatex.fmt and any LLVM language front end is not explained, and because a crash of the llvm-lto application should be categorized as a usability problem. FusionOS llvm-12.0.1-7.u2.fos23.x86_64.rpm llvm-libs-12.0.1-7.u2.fos23.x86_64.rpm llvm-devel-12.0.1-7.u2.fos23.x86_64.rpm llvm-help-12.0.1-7.u2.fos23.noarch.rpm llvm-12.0.1-7.u2.fos23.aarch64.rpm llvm-libs-12.0.1-7.u2.fos23.aarch64.rpm llvm-devel-12.0.1-7.u2.fos23.aarch64.rpm FusionOS-SA-2024-2134 Moderate FusionOS CVE-2023-38575:Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. FusionOS microcode_ctl-20240312-1.fos23.x86_64.rpm FusionOS-SA-2024-2135 Important FusionOS CVE-2024-27316:HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion. FusionOS mod_http2-1.15.25-3.u1.fos23.x86_64.rpm mod_http2-help-1.15.25-3.u1.fos23.noarch.rpm mod_http2-1.15.25-3.u1.fos23.aarch64.rpm FusionOS-SA-2024-2136 Important FusionOS CVE-2022-48279:In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-39956 but can be considered independent changes to the ModSecurity (C language) codebase. FusionOS mod_security-2.9.5-9.fos23.x86_64.rpm mod_security-2.9.5-9.fos23.aarch64.rpm FusionOS-SA-2024-2137 Moderate FusionOS CVE-2023-23599:When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7. CVE-2023-23601:Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7. CVE-2023-23602:A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7. FusionOS mozjs91-91.6.0-4.u1.fos23.x86_64.rpm libmozjs-91-0-91.6.0-4.u1.fos23.x86_64.rpm mozjs91-devel-91.6.0-4.u1.fos23.x86_64.rpm mozjs91-91.6.0-4.u1.fos23.aarch64.rpm libmozjs-91-0-91.6.0-4.u1.fos23.aarch64.rpm mozjs91-devel-91.6.0-4.u1.fos23.aarch64.rpm FusionOS-SA-2024-2138 Moderate FusionOS CVE-2024-28182:nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability. FusionOS nghttp2-1.46.0-6.u4.fos23.x86_64.rpm libnghttp2-1.46.0-6.u4.fos23.x86_64.rpm libnghttp2-devel-1.46.0-6.u4.fos23.x86_64.rpm nghttp2-help-1.46.0-6.u4.fos23.noarch.rpm nghttp2-1.46.0-6.u4.fos23.aarch64.rpm libnghttp2-1.46.0-6.u4.fos23.aarch64.rpm libnghttp2-devel-1.46.0-6.u4.fos23.aarch64.rpm FusionOS-SA-2024-2139 Low FusionOS CVE-2024-2511:Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue. FusionOS openssl-1.1.1m-34.u16.fos23.x86_64.rpm openssl-libs-1.1.1m-34.u16.fos23.x86_64.rpm openssl-perl-1.1.1m-34.u16.fos23.x86_64.rpm openssl-devel-1.1.1m-34.u16.fos23.x86_64.rpm openssl-help-1.1.1m-34.u16.fos23.noarch.rpm openssl-1.1.1m-34.u16.fos23.aarch64.rpm openssl-libs-1.1.1m-34.u16.fos23.aarch64.rpm openssl-perl-1.1.1m-34.u16.fos23.aarch64.rpm openssl-devel-1.1.1m-34.u16.fos23.aarch64.rpm FusionOS-SA-2024-2140 Important FusionOS CVE-2022-2639:An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system. FusionOS openvswitch-2.12.4-8.u6.fos23.x86_64.rpm openvswitch-devel-2.12.4-8.u6.fos23.x86_64.rpm openvswitch-help-2.12.4-8.u6.fos23.x86_64.rpm python3-openvswitch-2.12.4-8.u6.fos23.noarch.rpm openvswitch-2.12.4-8.u6.fos23.aarch64.rpm openvswitch-devel-2.12.4-8.u6.fos23.aarch64.rpm openvswitch-help-2.12.4-8.u6.fos23.aarch64.rpm FusionOS-SA-2024-2141 Important FusionOS CVE-2024-3019:A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually. The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This flaw affects PCP versions 4.3.4 and newer. FusionOS pcp-5.3.7-4.u4.fos23.x86_64.rpm pcp-conf-5.3.7-4.u4.fos23.x86_64.rpm pcp-devel-5.3.7-4.u4.fos23.x86_64.rpm pcp-help-5.3.7-4.u4.fos23.noarch.rpm perl-PCP-PMDA-5.3.7-4.u4.fos23.x86_64.rpm perl-PCP-MMV-5.3.7-4.u4.fos23.x86_64.rpm perl-PCP-LogImport-5.3.7-4.u4.fos23.x86_64.rpm perl-PCP-LogSummary-5.3.7-4.u4.fos23.x86_64.rpm pcp-import-sar2pcp-5.3.7-4.u4.fos23.x86_64.rpm pcp-import-iostat2pcp-5.3.7-4.u4.fos23.x86_64.rpm pcp-import-mrtg2pcp-5.3.7-4.u4.fos23.x86_64.rpm pcp-import-ganglia2pcp-5.3.7-4.u4.fos23.x86_64.rpm pcp-import-collectl2pcp-5.3.7-4.u4.fos23.x86_64.rpm pcp-export-zabbix-agent-5.3.7-4.u4.fos23.x86_64.rpm pcp-export-pcp2elasticsearch-5.3.7-4.u4.fos23.x86_64.rpm pcp-export-pcp2graphite-5.3.7-4.u4.fos23.x86_64.rpm pcp-export-pcp2influxdb-5.3.7-4.u4.fos23.x86_64.rpm pcp-export-pcp2json-5.3.7-4.u4.fos23.x86_64.rpm pcp-export-pcp2spark-5.3.7-4.u4.fos23.x86_64.rpm pcp-export-pcp2xml-5.3.7-4.u4.fos23.x86_64.rpm pcp-export-pcp2zabbix-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-podman-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-perfevent-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-infiniband-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-activemq-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-bind2-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-redis-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-nutcracker-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-bonding-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-dbping-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-ds389-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-ds389log-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-elasticsearch-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-gpfs-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-gpsd-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-denki-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-docker-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-lustre-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-lustrecomm-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-memcache-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-mysql-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-named-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-netfilter-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-news-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-nginx-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-nfsclient-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-oracle-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-pdns-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-postfix-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-postgresql-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-rsyslog-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-samba-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-slurm-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-snmp-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-zimbra-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-dm-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-bcc-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-bpf-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-bpftrace-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-gluster-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-zswap-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-unbound-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-mic-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-haproxy-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-libvirt-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-openvswitch-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-rabbitmq-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-lio-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-openmetrics-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-netcheck-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-mongodb-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-mssql-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-json-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-apache-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-bash-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-cifs-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-cisco-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-gfs2-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-lmsensors-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-logger-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-mailq-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-mounts-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-nvidia-gpu-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-roomtemp-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-sendmail-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-shping-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-smart-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-sockets-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-hacluster-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-summary-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-systemd-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-trace-5.3.7-4.u4.fos23.x86_64.rpm pcp-pmda-weblog-5.3.7-4.u4.fos23.x86_64.rpm pcp-zeroconf-5.3.7-4.u4.fos23.x86_64.rpm python3-pcp-5.3.7-4.u4.fos23.x86_64.rpm pcp-system-tools-5.3.7-4.u4.fos23.x86_64.rpm pcp-gui-5.3.7-4.u4.fos23.x86_64.rpm pcp-selinux-5.3.7-4.u4.fos23.x86_64.rpm pcp-5.3.7-4.u4.fos23.aarch64.rpm pcp-conf-5.3.7-4.u4.fos23.aarch64.rpm pcp-devel-5.3.7-4.u4.fos23.aarch64.rpm perl-PCP-PMDA-5.3.7-4.u4.fos23.aarch64.rpm perl-PCP-MMV-5.3.7-4.u4.fos23.aarch64.rpm perl-PCP-LogImport-5.3.7-4.u4.fos23.aarch64.rpm perl-PCP-LogSummary-5.3.7-4.u4.fos23.aarch64.rpm pcp-import-sar2pcp-5.3.7-4.u4.fos23.aarch64.rpm pcp-import-iostat2pcp-5.3.7-4.u4.fos23.aarch64.rpm pcp-import-mrtg2pcp-5.3.7-4.u4.fos23.aarch64.rpm pcp-import-ganglia2pcp-5.3.7-4.u4.fos23.aarch64.rpm pcp-import-collectl2pcp-5.3.7-4.u4.fos23.aarch64.rpm pcp-export-zabbix-agent-5.3.7-4.u4.fos23.aarch64.rpm pcp-export-pcp2elasticsearch-5.3.7-4.u4.fos23.aarch64.rpm pcp-export-pcp2graphite-5.3.7-4.u4.fos23.aarch64.rpm pcp-export-pcp2influxdb-5.3.7-4.u4.fos23.aarch64.rpm pcp-export-pcp2json-5.3.7-4.u4.fos23.aarch64.rpm pcp-export-pcp2spark-5.3.7-4.u4.fos23.aarch64.rpm pcp-export-pcp2xml-5.3.7-4.u4.fos23.aarch64.rpm pcp-export-pcp2zabbix-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-podman-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-perfevent-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-infiniband-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-activemq-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-bind2-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-redis-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-nutcracker-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-bonding-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-dbping-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-ds389-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-ds389log-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-elasticsearch-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-gpfs-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-gpsd-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-denki-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-docker-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-lustre-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-lustrecomm-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-memcache-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-mysql-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-named-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-netfilter-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-news-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-nginx-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-nfsclient-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-oracle-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-pdns-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-postfix-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-postgresql-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-rsyslog-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-samba-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-slurm-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-snmp-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-zimbra-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-dm-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-bpf-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-bpftrace-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-gluster-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-zswap-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-unbound-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-mic-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-haproxy-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-libvirt-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-openvswitch-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-rabbitmq-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-lio-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-openmetrics-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-netcheck-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-mongodb-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-json-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-apache-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-bash-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-cifs-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-cisco-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-gfs2-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-lmsensors-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-logger-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-mailq-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-mounts-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-nvidia-gpu-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-roomtemp-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-sendmail-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-shping-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-smart-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-sockets-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-hacluster-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-summary-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-systemd-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-trace-5.3.7-4.u4.fos23.aarch64.rpm pcp-pmda-weblog-5.3.7-4.u4.fos23.aarch64.rpm pcp-zeroconf-5.3.7-4.u4.fos23.aarch64.rpm python3-pcp-5.3.7-4.u4.fos23.aarch64.rpm pcp-system-tools-5.3.7-4.u4.fos23.aarch64.rpm pcp-gui-5.3.7-4.u4.fos23.aarch64.rpm pcp-selinux-5.3.7-4.u4.fos23.aarch64.rpm FusionOS-SA-2024-2142 Moderate FusionOS CVE-2024-2756:An improper input validation vulnerability was found in PHP. Due to an incomplete fix to CVE-2022-31629, network and same-site attackers can set a standard insecure cookie in the victim's browser. CVE-2024-3096:A null byte interaction error vulnerability was found in PHP. If a password stored with password_hash starts with a null byte (\x00), testing a blank string as the password via password_verify will incorrectly return true. If a user can create a password with a leading null byte (unlikely, but syntactically valid), an attacker could trivially compromise the victim's account by attempting to sign in with a blank string. FusionOS php-8.0.30-3.u1.fos23.x86_64.rpm php-cli-8.0.30-3.u1.fos23.x86_64.rpm php-dbg-8.0.30-3.u1.fos23.x86_64.rpm php-fpm-8.0.30-3.u1.fos23.x86_64.rpm php-common-8.0.30-3.u1.fos23.x86_64.rpm php-devel-8.0.30-3.u1.fos23.x86_64.rpm php-opcache-8.0.30-3.u1.fos23.x86_64.rpm php-ldap-8.0.30-3.u1.fos23.x86_64.rpm php-pdo-8.0.30-3.u1.fos23.x86_64.rpm php-mysqlnd-8.0.30-3.u1.fos23.x86_64.rpm php-pgsql-8.0.30-3.u1.fos23.x86_64.rpm php-process-8.0.30-3.u1.fos23.x86_64.rpm php-odbc-8.0.30-3.u1.fos23.x86_64.rpm php-soap-8.0.30-3.u1.fos23.x86_64.rpm php-snmp-8.0.30-3.u1.fos23.x86_64.rpm php-xml-8.0.30-3.u1.fos23.x86_64.rpm php-mbstring-8.0.30-3.u1.fos23.x86_64.rpm php-gd-8.0.30-3.u1.fos23.x86_64.rpm php-bcmath-8.0.30-3.u1.fos23.x86_64.rpm php-gmp-8.0.30-3.u1.fos23.x86_64.rpm php-dba-8.0.30-3.u1.fos23.x86_64.rpm php-tidy-8.0.30-3.u1.fos23.x86_64.rpm php-embedded-8.0.30-3.u1.fos23.x86_64.rpm php-intl-8.0.30-3.u1.fos23.x86_64.rpm php-enchant-8.0.30-3.u1.fos23.x86_64.rpm php-sodium-8.0.30-3.u1.fos23.x86_64.rpm php-ffi-8.0.30-3.u1.fos23.x86_64.rpm php-help-8.0.30-3.u1.fos23.x86_64.rpm php-8.0.30-3.u1.fos23.aarch64.rpm php-cli-8.0.30-3.u1.fos23.aarch64.rpm php-dbg-8.0.30-3.u1.fos23.aarch64.rpm php-fpm-8.0.30-3.u1.fos23.aarch64.rpm php-common-8.0.30-3.u1.fos23.aarch64.rpm php-devel-8.0.30-3.u1.fos23.aarch64.rpm php-opcache-8.0.30-3.u1.fos23.aarch64.rpm php-ldap-8.0.30-3.u1.fos23.aarch64.rpm php-pdo-8.0.30-3.u1.fos23.aarch64.rpm php-mysqlnd-8.0.30-3.u1.fos23.aarch64.rpm php-pgsql-8.0.30-3.u1.fos23.aarch64.rpm php-process-8.0.30-3.u1.fos23.aarch64.rpm php-odbc-8.0.30-3.u1.fos23.aarch64.rpm php-soap-8.0.30-3.u1.fos23.aarch64.rpm php-snmp-8.0.30-3.u1.fos23.aarch64.rpm php-xml-8.0.30-3.u1.fos23.aarch64.rpm php-mbstring-8.0.30-3.u1.fos23.aarch64.rpm php-gd-8.0.30-3.u1.fos23.aarch64.rpm php-bcmath-8.0.30-3.u1.fos23.aarch64.rpm php-gmp-8.0.30-3.u1.fos23.aarch64.rpm php-dba-8.0.30-3.u1.fos23.aarch64.rpm php-tidy-8.0.30-3.u1.fos23.aarch64.rpm php-embedded-8.0.30-3.u1.fos23.aarch64.rpm php-intl-8.0.30-3.u1.fos23.aarch64.rpm php-enchant-8.0.30-3.u1.fos23.aarch64.rpm php-sodium-8.0.30-3.u1.fos23.aarch64.rpm php-ffi-8.0.30-3.u1.fos23.aarch64.rpm php-help-8.0.30-3.u1.fos23.aarch64.rpm FusionOS-SA-2024-2143 Low FusionOS CVE-2024-27305:aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. FusionOS python3-aiosmtpd-1.4.2-2.u1.fos23.noarch.rpm python-aiosmtpd-help-1.4.2-2.u1.fos23.noarch.rpm FusionOS-SA-2024-2144 Moderate FusionOS CVE-2024-28219:In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. FusionOS python3-pillow-9.0.1-7.u4.fos23.x86_64.rpm python3-pillow-devel-9.0.1-7.u4.fos23.x86_64.rpm python3-pillow-help-9.0.1-7.u4.fos23.noarch.rpm python3-pillow-tk-9.0.1-7.u4.fos23.x86_64.rpm python3-pillow-qt-9.0.1-7.u4.fos23.x86_64.rpm python3-pillow-9.0.1-7.u4.fos23.aarch64.rpm python3-pillow-devel-9.0.1-7.u4.fos23.aarch64.rpm python3-pillow-tk-9.0.1-7.u4.fos23.aarch64.rpm python3-pillow-qt-9.0.1-7.u4.fos23.aarch64.rpm FusionOS-SA-2024-2145 Moderate FusionOS CVE-2024-21506:Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with string. If the following bytes are not printable UTF-8 the parser throws an exception with a single byte. FusionOS python3-bson-3.11.3-3.u2.fos23.x86_64.rpm python3-pymongo-3.11.3-3.u2.fos23.x86_64.rpm python3-pymongo-gridfs-3.11.3-3.u2.fos23.x86_64.rpm python-pymongo-help-3.11.3-3.u2.fos23.noarch.rpm python3-bson-3.11.3-3.u2.fos23.aarch64.rpm python3-pymongo-3.11.3-3.u2.fos23.aarch64.rpm python3-pymongo-gridfs-3.11.3-3.u2.fos23.aarch64.rpm FusionOS-SA-2024-2146 Moderate FusionOS CVE-2023-27043:The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python. FusionOS python3-3.9.9-29.u11.fos23.x86_64.rpm python3-unversioned-command-3.9.9-29.u11.fos23.x86_64.rpm python3-devel-3.9.9-29.u11.fos23.x86_64.rpm python3-debug-3.9.9-29.u11.fos23.x86_64.rpm python3-help-3.9.9-29.u11.fos23.noarch.rpm python3-3.9.9-29.u11.fos23.aarch64.rpm python3-unversioned-command-3.9.9-29.u11.fos23.aarch64.rpm python3-devel-3.9.9-29.u11.fos23.aarch64.rpm python3-debug-3.9.9-29.u11.fos23.aarch64.rpm FusionOS-SA-2024-2147 Moderate FusionOS CVE-2024-2397:Due to a bug in packet data buffers management, the PPP printer in tcpdump can enter an infinite loop when reading a crafted DLT_PPP_SERIAL .pcap savefile. This problem does not affect any tcpdump release, but it affected the git master branch from 2023-06-05 to 2024-03-21. FusionOS tcpdump-4.99.1-8.u2.fos23.x86_64.rpm tcpdump-help-4.99.1-8.u2.fos23.x86_64.rpm tcpdump-4.99.1-8.u2.fos23.aarch64.rpm tcpdump-help-4.99.1-8.u2.fos23.aarch64.rpm FusionOS-SA-2024-2148 Important FusionOS CVE-2022-39028:telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available through inetd. However, if the telnetd application has many crashes within a short time interval, the telnet service would become unavailable after inetd logs a "telnet/tcp server failing (looping), service terminated" error. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8. FusionOS telnet-0.17-79.u1.fos23.x86_64.rpm telnet-help-0.17-79.u1.fos23.x86_64.rpm telnet-0.17-79.u1.fos23.aarch64.rpm telnet-help-0.17-79.u1.fos23.aarch64.rpm FusionOS-SA-2024-2149 Important FusionOS CVE-2024-1013:An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian architectures, while big-endian architectures can be broken. FusionOS unixODBC-2.3.7-3.u2.fos23.x86_64.rpm unixODBC-devel-2.3.7-3.u2.fos23.x86_64.rpm unixODBC-2.3.7-3.u2.fos23.aarch64.rpm unixODBC-devel-2.3.7-3.u2.fos23.aarch64.rpm FusionOS-SA-2024-2150 Important FusionOS CVE-2024-28085:wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover. FusionOS util-linux-2.37.2-28.u13.fos23.x86_64.rpm libfdisk-2.37.2-28.u13.fos23.x86_64.rpm libsmartcols-2.37.2-28.u13.fos23.x86_64.rpm libmount-2.37.2-28.u13.fos23.x86_64.rpm libblkid-2.37.2-28.u13.fos23.x86_64.rpm uuidd-2.37.2-28.u13.fos23.x86_64.rpm libuuid-2.37.2-28.u13.fos23.x86_64.rpm util-linux-user-2.37.2-28.u13.fos23.x86_64.rpm python3-libmount-2.37.2-28.u13.fos23.x86_64.rpm util-linux-devel-2.37.2-28.u13.fos23.x86_64.rpm util-linux-help-2.37.2-28.u13.fos23.noarch.rpm util-linux-2.37.2-28.u13.fos23.aarch64.rpm libfdisk-2.37.2-28.u13.fos23.aarch64.rpm libsmartcols-2.37.2-28.u13.fos23.aarch64.rpm libmount-2.37.2-28.u13.fos23.aarch64.rpm libblkid-2.37.2-28.u13.fos23.aarch64.rpm uuidd-2.37.2-28.u13.fos23.aarch64.rpm libuuid-2.37.2-28.u13.fos23.aarch64.rpm util-linux-user-2.37.2-28.u13.fos23.aarch64.rpm python3-libmount-2.37.2-28.u13.fos23.aarch64.rpm util-linux-devel-2.37.2-28.u13.fos23.aarch64.rpm FusionOS-SA-2024-2151 Important FusionOS CVE-2024-30156:Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack. FusionOS varnish-7.4.3-1.fos23.x86_64.rpm varnish-devel-7.4.3-1.fos23.x86_64.rpm varnish-help-7.4.3-1.fos23.noarch.rpm varnish-7.4.3-1.fos23.aarch64.rpm varnish-devel-7.4.3-1.fos23.aarch64.rpm FusionOS-SA-2024-2152 Moderate FusionOS CVE-2023-0666:Due to failure in validating the length provided by an attacker-crafted RTPS packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark. FusionOS wireshark-3.6.14-7.u10.fos23.x86_64.rpm wireshark-devel-3.6.14-7.u10.fos23.x86_64.rpm wireshark-help-3.6.14-7.u10.fos23.x86_64.rpm wireshark-3.6.14-7.u10.fos23.aarch64.rpm wireshark-devel-3.6.14-7.u10.fos23.aarch64.rpm wireshark-help-3.6.14-7.u10.fos23.aarch64.rpm FusionOS-SA-2024-2153 Important FusionOS CVE-2024-31083:A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the system by sending a specially crafted request. CVE-2024-31080:A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads. CVE-2024-31081:A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads. CVE-2024-31082:A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads. CVE-2024-31083:A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the system by sending a specially crafted request. FusionOS xorg-x11-server-1.20.11-30.u15.fos23.x86_64.rpm xorg-x11-server-common-1.20.11-30.u15.fos23.x86_64.rpm xorg-x11-server-Xnest-1.20.11-30.u15.fos23.x86_64.rpm xorg-x11-server-Xdmx-1.20.11-30.u15.fos23.x86_64.rpm xorg-x11-server-Xvfb-1.20.11-30.u15.fos23.x86_64.rpm xorg-x11-server-Xephyr-1.20.11-30.u15.fos23.x86_64.rpm xorg-x11-server-devel-1.20.11-30.u15.fos23.x86_64.rpm xorg-x11-server-help-1.20.11-30.u15.fos23.noarch.rpm xorg-x11-server-source-1.20.11-30.u15.fos23.noarch.rpm xorg-x11-server-1.20.11-30.u15.fos23.aarch64.rpm xorg-x11-server-common-1.20.11-30.u15.fos23.aarch64.rpm xorg-x11-server-Xnest-1.20.11-30.u15.fos23.aarch64.rpm xorg-x11-server-Xdmx-1.20.11-30.u15.fos23.aarch64.rpm xorg-x11-server-Xvfb-1.20.11-30.u15.fos23.aarch64.rpm xorg-x11-server-Xephyr-1.20.11-30.u15.fos23.aarch64.rpm xorg-x11-server-devel-1.20.11-30.u15.fos23.aarch64.rpm FusionOS-SA-2024-2154 Important FusionOS CVE-2024-31080:A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads. CVE-2024-31081:A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads. CVE-2024-31083:A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the system by sending a specially crafted request. FusionOS xorg-x11-server-Xwayland-22.1.2-2.u1.fos23.x86_64.rpm xorg-x11-server-Xwayland-devel-22.1.2-2.u1.fos23.x86_64.rpm xorg-x11-server-Xwayland-22.1.2-2.u1.fos23.aarch64.rpm xorg-x11-server-Xwayland-devel-22.1.2-2.u1.fos23.aarch64.rpm