Schwachstellen, die jetzt zählen.

freerdp: freerdp: Use-after-free via rdpgfx dynamic virtual channel close

freerdp: freerdp: Out-of-bounds write in proxy bitmap cache v2 capability handling

freerdp: FreeRDP: Denial of Service via truncated input event

freerdp: FreeRDP: Heap buffer overflow via integer overflow in surface creation

org.glassfish/jakarta.faces: Eclipse Mojarra: Reflected cross-site scripting via unencoded client window parameter

In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. `h:button` renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With `com.sun.faces.enableCspNonce=true`, the…

git: Git for Windows: Denial of service via heap buffer overflow in git-credential-wincred

Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:* credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c allocates a buffer of exactly CredentialBlobSize bytes in match_cred_password() and then uses wcsncpy_s() to copy the corresponding number of wide characters plus a terminating NUL…

git: git: Denial of Service via heap buffer overflow in credential helper

Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-character credential buffer without space for the terminating NUL when both password and oauth_refresh_token are present. The operation also passes a byte count to _snwprintf_s() where a wide-character count is required, allowing the terminator to…

frr: frr: Unauthorized routing adjacency establishment via missing OSPFv3 address validation

In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets have a link-local source address and either a link-local destination or one of the protocol multicast destination groups. This may enable malicious actors to establish OSPFv3 adjacencies from unexpectedly, distant IPv6 hosts. Proper usage of OSPFv3 authentication trailers (RFC 7166, as is best practice) prevents full exploitation of this issue, though may…

activestorage: activestorage: arbitrary file read and write via ImageMagick attachment analysis

### Impact A Rails application that processes attachments with ImageMagick may allow an unauthenticated attacker to write arbitrary files on the server and, when attachments are stored with the Disk service, to read arbitrary files readable by the application process. Those files typically include `secret_key_base` and credentials for external systems, which may in turn allow escalation to remote code execution or lateral movement to those systems. ### Details ImageMagick…

sngrep: sngrep: Denial of Service via crafted SIP packet

zbar: zbar: Denial of Service via crafted SQ code image

qt6: qt6: Denial of Service via integer truncation in QTextCodec conversion functions

org.apache.zookeeper/zookeeper: Apache ZooKeeper: Denial of Service via unbounded multiRead response memory allocation

org.apache.zookeeper/zookeeper: ZooKeeper: Denial of Service via deeply nested znodes during snapshot creation

zookeeper: zookeeper: Denial of Service via improper exception handling in quota subsystem

org.apache.zookeeper/zookeeper: zookeeper: Privilege escalation via improper SASL authorization identity validation

org.apache.zookeeper/zookeeper: zookeeper: Authorization bypass via race condition in setACL handling

org.apache.activemq/activemq-broker: Apache ActiveMQ: Authorization bypass via crafted destination names in LDAP plugin

Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate the LDAP search base used for ACL lookups. This issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0 before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3 or…

Apache.NMS.ActiveMQ: Apache NMS ActiveMQ: Denial of Service via crafted OpenWire frames

org.apache.activemq/activemq-broker: org.apache.activemq/activemq-kahadb-store: ActiveMQ: unauthorized message access via user identifier spoofing

org.apache.activemq/activemq-runtime-config: Apache ActiveMQ: Authorization bypass via improper cache invalidation

org.apache.activemq/activemq-kahadb-store: activemq-kahadb-store: Denial of Service via oversized durable subscription identifiers

org.apache.activemq/activemq-broker: activemq-broker: Denial of Service via memory leak from rejected subscriptions

qt6: QHttpServer: Denial of Service via HTTP request resource exhaustion

DSA-6612-1 symfony - security update

ImageMagick: Mehrere Schwachstellen

DSA-6611-1 imagemagick - security update

ImageMagick: Mehrere Schwachstellen

DSA-6611-1 imagemagick - security update

ImageMagick: Mehrere Schwachstellen

DSA-6611-1 imagemagick - security update

DSA-6611-1 imagemagick - security update

DSA-6611-1 imagemagick - security update