Schwachstellen, die jetzt zählen.

DSA-6618-1 openexr - security update

DSA-6618-1 openexr - security update

DSA-6618-1 openexr - security update

DSA-6618-1 openexr - security update

DSA-6618-1 openexr - security update

DSA-6618-1 openexr - security update

DSA-6618-1 openexr - security update

DSA-6618-1 openexr - security update

DSA-6618-1 openexr - security update

DSA-6618-1 openexr - security update

DSA-6618-1 openexr - security update

DSA-6618-1 openexr - security update

DSA-6618-1 openexr - security update

DSA-6618-1 openexr - security update

DSA-6618-1 openexr - security update

DSA-6618-1 openexr - security update

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

thunderbird: OAuth2 access token could be sent over an unencrypted connection with Exchange accounts

DSA-6619-1 spip - security update

keycloak-services: keycloak-services: Delegated admin escalates to realm-admin via group move

xfsprogs: xfsprogs: Local privilege escalation via command injection in xfs_admin

Red Hat Enterprise Linux: Mehrere Schwachstellen

cockpit: Cockpit: Local privilege escalation via insecure symlink handling in public key addition helper

Red Hat Enterprise Linux: Mehrere Schwachstellen

cockpit: cockpit: Denial of Service via unbounded fragmented WebSocket messages

activestorage: Active Storage: Remote code execution via unsafe file extension handling in media processing

### Impact `ActiveStorage::Blob#open` writes a blob to a tempfile whose name carries the extension of the uploaded filename, and hands that path to `ffprobe` (`VideoAnalyzer`, `AudioAnalyzer`), `ffmpeg` (`VideoPreviewer`) and ImageMagick (`ImageAnalyzer`, the `:mini_magick` variant processor). These tools select a decoder from the file extension when the content does not identify its own format, so an attacker who chooses the filename and declares the content type of an…

activestorage: Active Storage: File size validation bypass via missing direct-upload content length constraints

### Impact `ActiveStorage::Service::GCSService#url_for_direct_upload` does not bind the declared content length into the signed direct-upload URL, and `#headers_for_direct_upload` returns no length constraint, so the URL authorizes an upload body of any size. A direct-upload client could store a file larger than the `byte_size` it declared, and the resulting blob keeps the declared size, possibly bypassing application file size validations and quotas. This is the weakness…

actionpack: actionpack: IP address spoofing via crafted Forwarded header

### Impact Since Rails 8.1.0, `ActionDispatch::RemoteIp` derives `request.remote_ip` from `Rack::Request#forwarded_for`, which under Rack 3 reads the RFC 7239 `Forwarded` header in preference to `X-Forwarded-For`. When a reverse proxy appends the client address to `X-Forwarded-For` but passes a client-supplied `Forwarded` header through unchanged, `request.remote_ip` returns an address chosen by the client, and the IP spoofing check does not raise, because it compares only…

activesupport: Active Support: Denial of Service via unescaped regular expressions in safe_constantize

### Impact When constant lookup raises `LoadError`, `ActiveSupport::Inflector#safe_constantize` (and `String#safe_constantize`) builds a regular expression from the requested constant name without escaping it, so a caller that passes untrusted input lets the attacker choose the source of a pattern that the application compiles. Crafted patterns can trigger defects in Ruby's regular expression compiler, possibly leading to a crash of the server process, and repeated requests…

actionpack: actionpack: Session retention across logout via race condition in CacheStore

### Impact `ActionDispatch::Session::CacheStore` writes a session back to the cache at the end of each request that loaded it, without checking that the session's cache entry still exists. When a concurrent request destroys the session, through `reset_session` on logout or by deleting its cache entry on the server, a request that loaded the session earlier and finishes later restores it under its original session ID. Logout and server-side revocation could therefore fail to…

activesupport: Active Support: Cross-site scripting via MessagePack deserialization

### Impact `ActiveSupport::MessagePack` serializes an `ActiveSupport::SafeBuffer` as its bytes alone and deserializes it as a new `SafeBuffer`, so a buffer that is no longer `html_safe?` (for example, one mutated in place with `gsub!`) is restored as `html_safe`. If such a buffer holds untrusted input and is stored through a MessagePack serializer, rendering it after it is loaded bypasses ERB auto-escaping, possibly leading to XSS. Applications on Rails 8.1 are affected if…

activestorage: activestorage: Denial of Service via filenames containing null bytes

### Impact `ActiveStorage::Filename#base` and `#extension_with_delimiter`, and therefore `#extension`, pass the stored filename unmodified to `File.basename` and `File.extname`, which raise `ArgumentError` when the name contains a NUL byte. Active Storage stores the client-supplied filename verbatim, so a user who is permitted to upload an attachment could persist such a filename on databases that accept NUL bytes in string columns, such as SQLite and MySQL/MariaDB. Each…

actionpack: Action Pack: Web cache poisoning via improper Vary header generation during content negotiation

### Impact Action Pack negotiates the format of a rendered response from the `Accept`, `X-Requested-With` and, for XHR requests without `Accept`, `Content-Type` request headers, but `ActionController::Rendering#_set_vary_header` adds `Vary: Accept` only when the request carries a usable `Accept` header and the response has no `Vary` header yet. A response to a request without `Accept`, or to an XHR request, therefore omits the headers that selected its representation, and a…