Search: 11.7-15

A cross-site scripting (XSS) vulnerability exists in GitLab versions 15.11 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. This flaw allows attackers to inject malicious scripts into web pages, potentially enabling the exfiltration of sensitive user information. The vulnerability has been assigned CVE-2024-4835 and is rated with high severity. Official patches addressing this issue are available in versions 16.10.6, 16.11.3, and 17.0.1.

Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.11.0. Security Fix(es): * Mozilla: Arbitrary JavaScript execution in PDF.js (CVE-2024-4367) * Mozilla: IndexedDB files retained in private browsing mode (CVE-2024-4767) * Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-4768) * Mozilla: Cross-origin responses could be distinguished between script and non-script content-types (CVE-2024-4769) * Mozilla: Use-after-free could occur when printing to PDF (CVE-2024-4770) * Mozilla: Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11 (CVE-2024-4777) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Integration - Service Registry 2.5.11 GA includes multiple security fixes addressing denial of service, memory leaks, and resource allocation issues in underlying components such as commons-compress, vert.x, and netty-codec-http. These vulnerabilities could lead to service disruption or resource exhaustion. The update is rated with a moderate security impact by Red Hat Product Security. No CVSS scores are provided in the advisory. The update is available as container images from the Red Hat Container Catalog.

A vulnerability in the Linux kernel's usbtv driver involved unnecessary locking calls in the usbtv_video_free() function, which could lead to deadlocks. This issue was more noticeable when disconnecting the device, even if not streaming. The problem has been fixed by removing these locks and an unnecessary usbtv_stop() call. The vulnerability affects certain Linux kernel versions prior to fixed releases around 5.15.0-107x series and some older 3.11 to 3.13 versions.

Vault and Vault Enterprise versions 1.14.0 up to but not including 1.16.0 have a vulnerability in the TLS certificates authentication method where OCSP responses are not correctly validated when multiple OCSP sources are configured. This issue is fixed in Vault 1.16.0 and Vault Enterprise versions 1.16.1, 1.15.7, and 1.14.11. The vulnerability has a medium severity rating and no known exploits in the wild have been reported.