Chromium: CVE-2024-6293 Use after free in Dawn

Command injection via array-ish $command parameter of procopen() (bypass CVE-2024-1874 fix)

Chromium: CVE-2024-5499 Out of bounds write in Streams API

Chromium: CVE-2024-5497 Out of bounds memory access in Keyboard Inputs

Chromium: CVE-2024-5493 Heap buffer overflow in WebRTC

Chromium: CVE-2024-5834 Inappropriate implementation in Dawn

Chromium: CVE-2024-5830 Type Confusion in V8

Chromium: CVE-2024-5833 Type Confusion in V8

Chromium: CVE-2024-5838 Type Confusion in V8

Chromium: CVE-2024-6292 Use after free in Dawn

Chromium: CVE-2024-5837 Type Confusion in V8

Chromium: CVE-2024-6290 Use after free in Dawn

Chromium: CVE-2024-5158 Type Confusion in V8

Chromium: CVE-2024-5835 Heap buffer overflow in Tab Groups

Chromium: CVE-2024-5836 Inappropriate Implementation in DevTools

btrfs: make sure that WRITTEN is set on all metadata blocks

Chromium: CVE-2024-5847 Use after free in PDFium

Chromium: CVE-2024-5846 Use after free in PDFium

Chromium: CVE-2024-4761 Out of bounds write in V8

MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file

An attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation.

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the objects/ directory. Cloning a local repository over the filesystem may creating hardlinks to arbitrary user-owned files on the same filesystem in the target Git repository's objects/ directory. When cloning a repository over the filesystem (without explicitly specifying the file:// protocol or --no-local), the optimizations for local cloning will be used, which include attempting to hard link the object files instead of copying them. While the code includes checks against symbolic links in the source repository, which were added during the fix for CVE-2022-39253, these checks can still be raced because the hard link operation ultimately follows symlinks. If the object on the filesystem appears as a file during the check, and then a symlink during the operation, this will allow the adversary to bypass the check and create hardlinks in the destination objects directory to arbitrary, user-readable files. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4.

Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with git clone --no-local to obtain a clean copy. Git has specific protections to make that a safe operation even with an untrusted source repository, but vulnerabilities allow those protections to be bypassed. In the context of cloning local repositories owned by other users, this vulnerability has been covered in CVE-2024-32004. But there are circumstances where the fixes for CVE-2024-32004 are not enough: For example, when obtaining a .zip file containing a full copy of a Git repository, it should not be trusted by default to be safe, as e.g. hooks could be configured to run within the context of that repository. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid using Git in repositories that have been obtained via archives from untrusted sources.

In the Linux kernel, the following vulnerability has been resolved:

firewire: nosy: ensure userlength is taken into account when fetching packet contents

Ensure that packetbufferget respects the userlength provided. If the length of the head packet exceeds the userlength, packetbufferget will now return 0 to signify to the user that no data were read and a larger buffer size is required. Helps prevent user space overflows.

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: once more fix the call oder in amdgputtmmove() v2

This reverts drm/amdgpu: fix ftrace event amdgpubomove always move on same heap. The basic problem here is that after the move the old location is simply not available any more.

Some fixes were suggested, but essentially we should call the move notification before actually moving things because only this way we have the correct order for DMA-buf and VM move notifications as well.

Also rework the statistic handling so that we don't update the eviction counter before the move.

v2: add missing NULL check

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix use-after-free bugs caused by scosocktimeout

The Linux kernel CVE team has assigned CVE-2024-27398 to this issue.

Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051355-CVE-2024-27398-08ef@gregkh/T

An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Description: The issue was addressed with improved checks. WebKit Bugzilla: 272750

Versions affected: WebKitGTK and WPE WebKit before 2.44.2.

Chromium: CVE-2024-5832 Use after free in Dawn

Chromium: CVE-2024-5839 Inappropriate Implementation in Memory Allocator

Chromium: CVE-2024-5845 Use after free in Audio