In the Linux kernel, the following vulnerability has been resolved:
firmware: armscmi: Harden accesses to the reset domains
Accessing reset domains descriptors by the index upon the SCMI drivers requests through the SCMI reset operations interface can potentially lead to out-of-bound violations if the SCMI driver misbehave.
Add an internal consistency check before any such domains descriptors accesses.
Last updated 24 July 2024
Last updated 24 July 2024
GNU Emacs could provide weaker than expected security, caused by an issue with contents of remote files to be trusted in Org mode. A remote attacker could exploit this vulnerability to launch further attacks on the system.
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: mark set as dead when unbinding anonymous set with timeout
The Linux kernel CVE team has assigned CVE-2024-26643 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024032150-CVE-2024-26643-4f9d@gregkh/T
Last updated 28 February 2025
Last updated 24 July 2024
AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding() and AppendEncodedCharacters() could have experienced integer overflows, causing underallocation of an output buffer leading to an out of bounds write.
External Reference: https://www.mozilla.org/en-US/security/advisories/mfsa2024-13/#CVE-2024-2608
A stack-based buffer overflow vulnerability in gross 0.9.3 through 1.x before 1.0.4 allows remote attackers to trigger a denial of service (grossd daemon crash) or potentially execute arbitrary code in grossd via crafted SMTP transaction parameters that cause an incorrect strncat for a log entry.
Last updated 24 July 2024
A malicious devtools extension could have been used to escalate privileges.
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions.
A use-after-free was identified in the nsDNSService::Init. This issue appears to manifest rarely during start-up.
External Reference: https://www.mozilla.org/en-US/security/advisories/mfsa2023-54/#CVE-2023-6862
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
The ACEManager component of ALEOS 4.16 and earlier does not
perform input sanitization during authentication, which could
potentially result in a Denial of Service (DoS) condition for
ACEManager without impairing other router functions. ACEManager
recovers from the DoS condition by restarting within ten seconds of
becoming unavailable.
Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.
When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not unlike the clipboard. This bug only affects Firefox on X11. Other systems are unaffected. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.
Ownership mismanagement led to a use-after-free in ReadableByteStreams
open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack the /dev/uinput file descriptor allowing them to simulate user inputs.
VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .
Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash.
During garbage collection extra operations were performed on a object that should not be. This could have led to a potentially exploitable crash.
Last updated 24 July 2024
Impact
Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be impacted if PHP also has registerargcargv enabled in php.ini.
Patches
2.6.4, 2.2.22 and 1.10.27 patch this vulnerability.
Workarounds
Make sure registerargcargv is disabled in php.ini, and avoid publishing composer.phar to the web as this really should not happen.
Accounts. A permissions issue was addressed with additional restrictions.
OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.
An issue was discovered in FRRouting FRR through 9.0. bgpnlriparseflowspec in bgpd/bgpflowspec.c processes malformed requests with no attributes, leading to a NULL pointer dereference.