Threat database

Red Hat has issued a security advisory for Mozilla Firefox addressing multiple vulnerabilities including a race condition in permission assignment (CVE-2024-6601), memory corruption in thread creation (CVE-2024-6603), and memory safety bugs (CVE-2024-6604). These issues affect Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13. The update is rated as Important by Red Hat and fixes are available for Red Hat Enterprise Linux 8.4 variants.

A side-channel information leak vulnerability (CVE-2024-28834) affecting the GnuTLS library has been identified and addressed by Red Hat. This vulnerability, known as the Minerva side-channel leak, impacts cryptographic operations within GnuTLS, which implements SSL, TLS, and DTLS protocols. Red Hat has released security updates for Red Hat Enterprise Linux 8.6 Extended Update Support and related variants to fix this issue. The severity is rated as moderate by Red Hat. No public exploit code or in-the-wild exploitation has been reported. Users of affected Red Hat Enterprise Linux 8.6 Extended Update Support versions should apply the provided updates to remediate the vulnerability.

CVE-2024-28835 is a vulnerability in GnuTLS version 3.8.3 where an application crash can be triggered by verifying a specially crafted .pem certificate bundle using the certtool --verify-chain command. This flaw results in an uncaught exception leading to denial of service. The issue has a medium severity rating with a CVSS score of 5. A security update addressing this vulnerability is available from Red Hat for their Enterprise Linux 9 distributions.

CVE-2024-23687 is a critical vulnerability in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2. It involves hard-coded credentials that allow unauthenticated users to access sensitive APIs. Exploitation can lead to unauthorized modification of user data, configuration settings including single-sign-on, and fees/fines management.

A global buffer overflow vulnerability exists in the GetSsmlAttribute function of espeak-ng versions 1.51 and 1.52.0. This issue was reported by OSS-Fuzz and involves an out-of-bounds read leading to a crash. The vulnerability has been fixed in a later commit.

A memory safety issue (UNKNOWN READ) has been reported in the kimageformats component, specifically in the function mc_chroma<unsigned short>. The issue was identified by OSS-Fuzz and involves a crash during inter prediction sample generation and prediction unit decoding. Multiple versions of kimageformats from 5.80.0 through 5.90.0-rc1 are affected. No CVSS score or detailed impact information is provided, and no public exploit or patch information is available.

A use-of-uninitialized-value vulnerability was identified in the kimageformats component, specifically in the decode_CABAC_FL_bypass function. This issue was reported by OSS-Fuzz and involves uninitialized memory usage during decoding operations.

A use-of-uninitialized-value vulnerability was reported in the kimageformats component, specifically in the intra_prediction_angular function template. The issue was identified by OSS-Fuzz and involves uninitialized memory usage during intra prediction decoding.