Multiple security issues were addressed in the chromedriver-128.0.6613.113-1.1 package for openSUSE Tumbleweed. These fixes improve the security posture of the chromedriver component distributed with this SUSE product. No specific vulnerability details or affected versions are provided.
A security update for Chromium addresses multiple vulnerabilities including type confusion issues in the V8 JavaScript engine and heap buffer overflows in the Skia graphics library. These vulnerabilities are identified as CVE-2024-7969, CVE-2024-8193, CVE-2024-8194, and CVE-2024-8198. The update fixes these issues in Chromium version 128.0.6613.113. No CVSS score is provided, but the severity is assessed as high.
A Time-of-check Time-of-use (TOCTOU) race condition vulnerability exists in the pg_dump utility of PostgreSQL. This flaw allows an object creator to execute arbitrary SQL functions with the privileges of the user running pg_dump, which is often a superuser. The attack involves replacing a relation type with a view or foreign table during the dump process. Versions prior to PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected. A patch is available to address this issue.
Red Hat has issued an important security update for PostgreSQL 16 addressing two vulnerabilities: CVE-2024-4317, which involves missing authorization checks in pg_stats_ext and pg_stats_ext_exprs, and CVE-2024-7348, where relation replacement during pg_dump can execute arbitrary SQL. These vulnerabilities could allow unauthorized actions within the database system. The update applies to Red Hat Enterprise Linux 9 and its various update and support streams. Users are advised to apply the update as detailed in the Red Hat advisory to mitigate these issues.
A security update for Chromium version 128.0.6613.84 addresses multiple high-severity vulnerabilities including use-after-free, type confusion, heap buffer overflows, and insufficient data validation across various components such as Passwords, V8 JavaScript engine, Skia graphics library, Fonts, Autofill, PDFium, Permissions, and others. These vulnerabilities were identified through internal audits and fuzzing efforts. No CVSS score is provided for these issues.
Red Hat has issued an important security update for Firefox on Red Hat Enterprise Linux 7 Extended Lifecycle Support addressing multiple vulnerabilities including CVE-2024-7518 and ten additional CVEs. The advisory covers updated Firefox packages for various architectures. The update aims to remediate several security issues with a high severity rating. No explicit technical details or CVSS scores are provided in the summary, but users are directed to individual CVE pages for more information. The update is available for Red Hat Enterprise Linux 7 ELS and related architectures.
This is a low severity security update for the dotnet8.0 package provided by SUSE, functionally equivalent to Red Hat advisory RHSA-2024:5334. No specific affected versions or detailed vulnerability information is provided.
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
Security Fix(es):
* bind: bind9: BIND's database will be slow if a very large number of RRs exist at the same nam (CVE-2024-1737)
* bind9: bind: SIG(0) can be used to exhaust CPU resources (CVE-2024-1975)
* bind: bind9: Assertion failure when serving both stale cache data and authoritative zone content (CVE-2024-4076)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Two denial of service vulnerabilities have been identified in Squid, a high-performance proxy caching server. The first vulnerability (CVE-2024-23638) affects Cache Manager error responses, and the second (CVE-2024-45802) affects processing of ESI response content. These issues could cause the Squid service to become unavailable. Red Hat has issued security updates addressing these vulnerabilities for Red Hat Enterprise Linux 8 and related distributions. Users should apply the provided updates to mitigate these issues.
Red Hat has released an important security update for the Apache HTTP Server (httpd) packages addressing multiple vulnerabilities in the mod_rewrite and mod_proxy modules. The issues include improper escaping of output, substitution encoding problems, null pointer dereference, potential server-side request forgery (SSRF), and encoding problems. These vulnerabilities affect Red Hat Enterprise Linux 9 and its Extended Update Support and Extended Life Cycle versions across multiple architectures. Updated packages are available to remediate these issues.
A moderate severity security vulnerability (CVE-2024-35235) has been identified in the Common UNIX Printing System (CUPS) affecting Red Hat Enterprise Linux 9.2 Extended Update Support and related variants. The vulnerability involves an arbitrary chmod operation with mode 0140777 in the cups daemon's listen functionality. Red Hat has released a security update to address this issue.
A security update for libuv addresses an improper domain lookup vulnerability (CVE-2024-24806) that could potentially lead to Server-Side Request Forgery (SSRF) attacks. This vulnerability affects multiple Red Hat Enterprise Linux 8 variants and related products. The issue has been rated with moderate severity by Red Hat Product Security. An update to libuv version 1.41.1-2.el8_10 is available to fix this vulnerability. No known exploits are reported in the wild at this time.
Multiple security vulnerabilities have been identified and fixed in the java-1.8.0-openjdk packages, which provide the OpenJDK 8 Java Runtime Environment and Software Development Kit. These include array index overflow, UTF8 size overflow, infinite loop due to excessive symbol length, pre-loop limit overflow, improper header validation causing increased loading time, and out-of-bounds access in 2D image handling. The vulnerabilities affect various Red Hat Enterprise Linux and SUSE versions. A security update is available and must be applied, followed by restarting all running OpenJDK Java instances for the fixes to take effect.
.NET 8.0 has multiple denial-of-service (DoS) vulnerabilities affecting System.Text.Json, ASP.NET Core 8, and X.509 content parsing. Updated versions .NET SDK 8.0.107 and Runtime 8.0.7 address these issues. Red Hat has released security updates for their Enterprise Linux 9 distributions to remediate these vulnerabilities.