Threats Tagged 'cwe-364'

CVE-2026-4684 is a high-severity vulnerability in Mozilla Firefox involving a race condition and use-after-free in the Graphics: WebRender component. This flaw could lead to memory corruption and potentially allow arbitrary code execution. The issue affects Firefox versions prior to 149 and Firefox ESR versions prior to 115.34 and 140.9. Mozilla has released official fixes in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. No known exploits in the wild have been reported.

The Red Hat Storage Ceph container images are based on the latest ubi9 base image and Ceph 8.1. This release updates to the latest version.

CVE-2024-6409 is a race condition vulnerability in OpenSSH's server (sshd) signal handling. The issue arises when sshd's SIGALRM handler is called asynchronously if a remote attacker fails to authenticate within a set time. The signal handler invokes functions that are not async-signal-safe, such as syslog(), which can lead to a race condition. This vulnerability may allow remote code execution (RCE) as an unprivileged user running the sshd server. The vulnerability affects OpenSSH versions from 9.0 up to but not including 9.0.3. Red Hat has issued security advisories and updates addressing this flaw for Red Hat Enterprise Linux 9 and OpenShift Container Platform 4.16.4. The CVSS v3.1 base score is 7.0, indicating high severity. No known exploits in the wild have been reported at this time.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.15.22. Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html Security Fix(es): * openssh: Possible remote code execution due to a race condition in signal handling (CVE-2024-6387) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html

In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or a segmentation fault if a shutdown signal (SIGTERM, SIGINT or SIGHUP) is received before the JVM has finished initializing.

MediumVulnerabilityGermanyFranceUnited Kingdom+3#cve#cve-2023-5676#cwe-364