Threat database

This entry references a security update for Ruby provided by the SUSE Product Security Team, which is functionally equivalent to Red Hat's advisory RHSA-2024:3671. No specific vulnerability details, affected versions, or technical impact are provided in the input data. The severity is noted as low, and no CVSS score or exploit information is available.

A security update was released for the SUSE Linux Enterprise 15 SP5 RT kernel addressing various security bugfixes. This update also fixes a regression affecting kerberized NFSv4 shares introduced in a previous update.

A security vulnerability (CVE-2024-1135) affecting Gunicorn, a Python WSGI HTTP server used in Red Hat OpenStack Platform 17.1, allows HTTP Request Smuggling due to improper validation of Transfer-Encoding headers. This flaw could enable attackers to interfere with HTTP request processing. Red Hat has issued an important security update to address this issue in python-gunicorn packages for OpenStack 17.1 on RHEL 9.

A moderate severity vulnerability (CVE-2024-22195) in the python-jinja2 package allows HTML attribute injection when user input is passed as keys to the xmlattr filter. This flaw affects the Jinja2 template engine used in Red Hat Enterprise Linux 8. A security update is available that addresses this issue. Users must apply the update and restart all applications using Jinja2 for the fix to take effect.

CVE-2024-0510 is a critical server-side request forgery (SSRF) vulnerability in HaoKeKeJi YiQiNiu versions 3.0 and 3.1. It affects the http_post function in the /application/pay/controller/Api.php file. An attacker can manipulate the 'url' argument to cause the server to make unauthorized requests. The vulnerability is remotely exploitable and has public exploit code disclosed. The CVSS 3.1 base score is 7.3, indicating high severity.

A heap-buffer-overflow vulnerability exists in the libucl library within the function ucl_object_dtor_unref_single. This issue was identified by OSS-Fuzz and involves an out-of-bounds read of 8 bytes during object destruction.

A use-of-uninitialized-value vulnerability was reported in libhevc, specifically in the function ihevce_strm_fill_done. The issue was identified by OSS-Fuzz and involves uninitialized memory usage that could lead to undefined behavior or crashes.

A use-of-uninitialized-value vulnerability was reported in libhevc affecting multiple versions up to 1.8.7. The issue occurs in the complexity_RC_reset_marking function and was identified by OSS-Fuzz. No CVSS score or detailed impact information is provided.

A use-of-uninitialized-value vulnerability was reported in libhevc affecting multiple versions. The issue was identified by OSS-Fuzz and involves the function ihevce_enc_frm_proc_slave_thrd, potentially leading to undefined behavior or crashes.