Schwachstellen, die jetzt zählen.

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

firefox: thunderbird: Use-after-free in the DOM: Core & HTML component

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

firefox: thunderbird: Incorrect boundary conditions in the DOM: Core & HTML component

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

firefox: thunderbird: Use-after-free in the Layout component

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

firefox: thunderbird: Use-after-free in the Audio/Video component

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Service Workers component

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

firefox: thunderbird: Use-after-free in the DOM: HTML Parser component

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

firefox: thunderbird: Use-after-free in the DOM: Core & HTML component

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

Sandbox escape due to use-after-free in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

firefox: thunderbird: Use-after-free in the Audio/Video component

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

firefox: thunderbird: Use-after-free in the DOM: HTML Parser component

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

firefox: thunderbird: Incorrect boundary conditions in the Networking: HTTP component

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

firefox: thunderbird: Sandbox escape in the DOM: Navigation component

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

Busybox: heap buffer overflow in wget ftp resume when the resume offset exceeds the reported file size

A flaw was found in BusyBox. When resuming a download over File Transfer Protocol (FTP), the wget utility fails to verify that the resume offset does not exceed the file size reported by the server, resulting in an integer calculation error. A malicious FTP server or an on-path network attacker can exploit this issue by returning crafted file size metadata, triggering a heap-based buffer overflow with attacker-controlled data. Successful exploitation may allow an attacker to…

A flaw was found in GStreamer's MXF demuxer.

A flaw was found in GStreamer's MXF demuxer. When an application processes a crafted MXF file, an off-by-one bounds check can allow a one-byte write past the logical end of a temporal offset array. This may corrupt memory and cause the application to crash. The extent of the impact has not been demonstrated by a runtime test.

A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin.

A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG Program Stream file can cause an out-of-bounds read and potentially crash the application, resulting in a denial of service.

Red Hat Enterprise Linux: Mehrere Schwachstellen

A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, an error path frees a mapped buffer before unmapping it. Applications that parse untrusted caps or structure data can reach a freed-buffer read and may crash. A network-facing GStreamer Data Protocol receiver can process such caps data without user interaction; further impact has not been established.

A flaw was found in the GStreamer gst-plugins-bad MXF plugin.

A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancillary packets can cause an out-of-bounds write. Processing affected content may crash the application, resulting in a denial of service.

PackageKit: PackageKit: Privilege escalation via security update rollback in Zypp backend

Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing privilege escalation.

cockpit: cockpit-storaged: Tang keyserver address from an untrusted LUKS header clevis token reaches curl's argument vector as an option

MIT Kerberos: Mehrere Schwachstellen

krb5: Unauthenticated KDC DoS based on ASN.1 decoder read overrun

grafana: RECORDED QUERIES REMOTE-WRITE VALIDATION COULD USE DATA SOURCE CREDENTIALS BEFORE CHECKING PERMISSIONS

konflux-ci: Unvalidated hostname fields enable Caddyfile config injection in the Konflux UI proxy generator, allowing an unauthenticated route to be spliced…

A flaw was found in the Konflux UI proxy. Hostname values defined in the KonfluxUI custom resource are inserted directly into proxy configuration files without adequate validation or sanitization. An authenticated user with permissions to modify the custom resource can inject malicious configuration directives to bypass authentication and authorization controls, potentially exposing internal backend services. In addition, providing malformed input can cause the configuration…

flightctl-api: flightctl-remote-access: flightctl: Unbounded TLS handshake in ConnContext can block accepting connections

A flaw was found in flightctl. A TLS handshake is performed synchronously in the HTTP server’s connection-context callback without a deadline. A network-reachable unauthenticated client can stall the handshake and prevent the affected listener from accepting new connections.

keycloak-services: keycloak-services: Login-failure upsert trusts MySQL/MariaDB affected-row count

Grafana: Mehrere Schwachstellen

A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery).