Threat database

Multiple security vulnerabilities affecting Mozilla Thunderbird have been addressed in Red Hat Enterprise Linux 8 updates. These include memory safety bugs, a race condition in permission assignment, and memory corruption in thread creation. The update fixes issues tracked as CVE-2024-6601, CVE-2024-6603, and CVE-2024-6604. Red Hat has rated the update as important and recommends applying the Thunderbird 115.13 update to remediate these vulnerabilities.

A side-channel information leak vulnerability (CVE-2024-28834) affecting the GnuTLS library has been identified and addressed by Red Hat. This vulnerability, known as the Minerva side-channel leak, impacts cryptographic operations within GnuTLS, which implements SSL, TLS, and DTLS protocols. Red Hat has released security updates for Red Hat Enterprise Linux 8.6 Extended Update Support and related variants to fix this issue. The severity is rated as moderate by Red Hat. No public exploit code or in-the-wild exploitation has been reported. Users of affected Red Hat Enterprise Linux 8.6 Extended Update Support versions should apply the provided updates to remediate the vulnerability.

CVE-2024-28835 is a vulnerability in GnuTLS version 3.8.3 where an application crash can be triggered by verifying a specially crafted .pem certificate bundle using the certtool --verify-chain command. This flaw results in an uncaught exception leading to denial of service. The issue has a medium severity rating with a CVSS score of 5. A security update addressing this vulnerability is available from Red Hat for their Enterprise Linux 9 distributions.

CVE-2024-23687 is a critical vulnerability in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2. It involves hard-coded credentials that allow unauthenticated users to access sensitive APIs. Exploitation can lead to unauthorized modification of user data, configuration settings including single-sign-on, and fees/fines management.

A global buffer overflow vulnerability exists in the GetSsmlAttribute function of espeak-ng versions 1.51 and 1.52.0. This issue was reported by OSS-Fuzz and involves an out-of-bounds read leading to a crash. The vulnerability has been fixed in a later commit.

A memory safety issue (UNKNOWN READ) has been reported in the kimageformats component, specifically in the function mc_chroma<unsigned short>. The issue was identified by OSS-Fuzz and involves a crash during inter prediction sample generation and prediction unit decoding. Multiple versions of kimageformats from 5.80.0 through 5.90.0-rc1 are affected. No CVSS score or detailed impact information is provided, and no public exploit or patch information is available.

A use-of-uninitialized-value vulnerability was identified in the kimageformats component, specifically in the decode_CABAC_FL_bypass function. This issue was reported by OSS-Fuzz and involves uninitialized memory usage during decoding operations.

A use-of-uninitialized-value vulnerability was reported in the kimageformats component, specifically in the intra_prediction_angular function template. The issue was identified by OSS-Fuzz and involves uninitialized memory usage during intra prediction decoding.