The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
openjpeg: A heap-based buffer overflow flaw was found in the patch for CVE-2013-6045. A crafted j2k image could cause the application to crash, or potentially execute arbitrary code.
A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp socket, which would cause rsyslog to crash.
A flaw was found in the way the ntp-keygen utility generated MD5 symmetric keys on big-endian systems. This could possibly allow an attacker to guess generated MD5 keys that could then be used to spoof an NTP client or server.
If the lowest byte of the temp variable is outside of the printable characters range (between 0x20 and 0x7f), the ntp-keygen utility enters an infinite loop. However, if the temp variable is within the aforementioned range, the generated MD5 key will consist of 20 identical characters, meaning only 93 possible keys can be generated.
Upstream bug:
https://bugs.ntp.org/showbug.cgi?id=2797
Upstream patch:
http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=55199296N2gFqH1Hm5GOnhrk9Ypygg
CVE request:
http://seclists.org/oss-sec/2015/q2/85
Important: tigervnc security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.Security Fix(es): gstreamer: MXF demuxer use-after-free vulnerability (CVE-2023-44446) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Important: xorg-x11-server security update
Important: kernel security and bug fix update
Important: X.Org server security update
Important: shim security update
Important: kernel security and bug fix update
Important: Satellite Client Async Security Update
Important: tigervnc security update
Important: rhc-worker-script security and enhancement update
389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.<br>Security Fix(es):<br><li> 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request (CVE-2024-3657)</li> <li> 389-ds-base: Malformed userPassword may cause crash at domodify in slapd/modify.c (CVE-2024-2199)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Important: glibc security update
Important: less security update
Important: bind, bind-dyndb-ldap, and dhcp security update
Important: ipa security update
Important: linux-firmware security update
Flatpak is a system for building, distributing, and running sandboxed desktopapplications on Linux.Security Fix(es): flatpak: sandbox escape via RequestBackground portal (CVE-2024-32462) For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer the CVE page(s)listed in the References section.
Important: pki-core security update
Important: kernel security and bug fix update
Important: bind security update
Important: bind security update
Important: kernel security and bug fix update
IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.This update upgrades IBM Java SE 8 to version 8 SR8-FP5.Security Fix(es): OpenJDK: improper connection handling during TLS handshake (8294474) (CVE-2023-21930) OpenJDK: Swing HTML parsing issue (8296832) (CVE-2023-21939) OpenJDK: certificate validation issue in TLS session negotiation (8298310) (CVE-2023-21967) OpenJDK: missing string checks for NULL characters (8296622) (CVE-2023-21937) OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304) (CVE-2023-21938) OpenJDK: missing check for slash characters in URI-to-path conversion (8298667) (CVE-2023-21968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Important: openssh security update
Important: open-vm-tools security update