Two security issues were discovered in MediaWiki, a website engine for collaborative work, which could result in cross-site scripting or denial of service.

Skyler Ferrante discovered that the wall tool from util-linux does not properly handle escape sequences from command line arguments. A local attacker can take advantage of this flaw for information disclosure.

In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23. (CVE-2024-30202) In Emacs before 29.3, Gnus treats inline MIME contents as trusted. (CVE-2024-30203)

Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access. (CVE-2023-22655) Information exposure through microarchitectural state after transient

Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `–with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a

These are bug fix and security releases including MODERATE, HIGH, and CRITICAL issues.

release v1.11.0 release v1.10.1 release v1.10.0

podman-tui release v1.0.0 Security fix for [CVE-2024-28180]

x86: Register File Data Sampling [XSA-452, CVE-2023-28746] GhostRace: Speculative Race Conditions [XSA-453, CVE-2024-2193]

Automatic update for cockpit-314-1.fc39.

This update contains security fixes for CVE-2024-29131 and CVE-2024-29133. See https://github.com/apache/commons-configuration/blob/master/RELEASE- NOTES.txt for changes in versions 2.10.0 and 2.10.1.

Security fix for CVE-2023-35936 and CVE-2023-38745 pandoc: backport fixes for CVE-2023-35936 and CVE-2023-38745 pandoc-cli: new package for pandoc binary

Security fix for CVE-2023-35936 and CVE-2023-38745 pandoc: backport fixes for CVE-2023-35936 and CVE-2023-38745 pandoc-cli: new package for pandoc binary

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

Version 6.7.4 (2024-03-21) Upgrade tcpdf tag encryption algorithm. Version 6.7.3 (2024-03-20) Fix regression issue #699. Version 6.7.2 (2024-03-18)

podman-tui release v1.0.0

This update contains security fixes for CVE-2024-29131 and CVE-2024-29133. See https://github.com/apache/commons-configuration/blob/master/RELEASE- NOTES.txt for changes in versions 2.10.0 and 2.10.1.

CVE-2024-2004: Usage of disabled protocol If all protocols are disabled at run-time with none being added, curl/libcurl would still allow communication with the default set of allowed protocols, including some that are unencrypted. CVE-2024-2398: HTTP/2 push headers memory-leak

update to 123.0.6312.86 Critical CVE-2024-2883: Use after free in ANGLE High CVE-2024-2885: Use after free in Dawn High CVE-2024-2886: Use after free in WebCodecs High CVE-2024-2887: Type Confusion in WebAssembly

* bsc#1218610 Cross-References: * CVE-2023-51779

* bsc#1218487 * bsc#1218610 Cross-References: * CVE-2023-51779

* bsc#1218487 Cross-References: * CVE-2023-6531

* bsc#1208911 * bsc#1215887 * bsc#1216898 * bsc#1218487 * bsc#1218610

* bsc#1218487 * bsc#1218610 * bsc#1219157 Cross-References:

* bsc#1215887 * bsc#1216898 * bsc#1218487 * bsc#1218610

Several security issues were fixed in curl.

* bsc#1221237 * bsc#1221468 Cross-References: * CVE-2024-1441

* bsc#1220770 * bsc#1220771 Cross-References: * CVE-2024-26458

* bsc#1144060 * bsc#1176006 * bsc#1188307 * bsc#1203823 * bsc#1205502

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

* bsc#1218487 * bsc#1218610 * bsc#1219157 Cross-References:

* bsc#1215887 * bsc#1216898 * bsc#1218487 * bsc#1218610

Several security issues were fixed in Thunderbird.

PAM could be made to stop responding if it opened a specially crafted file.

* bsc#1215887 * bsc#1216898 * bsc#1218487 * bsc#1218610

* bsc#1218487 * bsc#1218610 * bsc#1219157 Cross-References:

Stack-based buffer overflow has been fixed in gross, a server for greylisting emails. For Debian 10 buster, this problem has been fixed in version

QPDF could be made to crash or run programs if it opened a specially crafted file.

Net::CIDR::Lite could allow unintended access to network services.

It was discovered that there was a command-line injection issue in the FreeIPA identity, authentication and audit framework. A specially crafted HTTP request could have lead to a Denial of Service (DoS) attack and/or data exposure.

Several security issues were fixed in Firefox.

New upstream version (124.0.1)

Multiple security vulnerabilities have been discovered in Cacti, a web interface for graphing of monitoring systems, which could result in cross-site scripting, SQL injection, or command injection.

Buffer Overflow vulnerability in FreeImage_AllocateBitmap. (CVE-2023-47995) Infinite loop exits in Load in PluginTIFF.cpp. (CVE-2023-47997) References: