Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Fedora
(Fedoraproject)| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2023-06-23 | CVE-2023-3212 | A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic. | Debian_linux, Fedora, Linux_kernel, H300s_firmware, H410c_firmware, H410s_firmware, H500s_firmware, H700s_firmware, Enterprise_linux | 4.4 | ||
| 2023-06-27 | CVE-2023-3431 | Improper Access Control in GitHub repository plantuml/plantuml prior to 1.2023.9. | Fedora, Plantuml | 5.3 | ||
| 2023-06-27 | CVE-2023-3432 | Server-Side Request Forgery (SSRF) in GitHub repository plantuml/plantuml prior to 1.2023.9. | Fedora, Plantuml | 10.0 | ||
| 2023-06-30 | CVE-2023-1206 | A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95%. | Fedora, Linux_kernel, Enterprise_linux | 5.7 | ||
| 2023-07-03 | CVE-2023-36053 | In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs. | Debian_linux, Django, Fedora | 7.5 | ||
| 2023-07-05 | CVE-2023-31248 | Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace | Ubuntu_linux, Debian_linux, Fedora, Linux_kernel | 7.8 | ||
| 2023-07-05 | CVE-2023-35001 | Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace | Debian_linux, Fedora, Linux_kernel, H300s, H410c, H410s, H500s, H700s | 7.8 | ||
| 2023-07-06 | CVE-2023-35934 | yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for `curl` and `httpie` (version 3.1.0 or... | Fedora, Youtube\-Dlc, Youtube\-Dl, Yt\-Dlp | 8.2 | ||
| 2023-07-10 | CVE-2023-1183 | A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker. | Fedora, Libreoffice, Enterprise_linux | 5.5 | ||
| 2023-07-10 | CVE-2023-34432 | A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at sox/src/formats_i.c:98:16. This flaw can lead to a denial of service, code execution, or information disclosure. | Extra_packages_for_enterprise_linux, Fedora, Enterprise_linux, Sound_exchange | 7.8 |