* bsc#1233712 Cross-References: * CVE-2024-50264

* bsc#1225819 * bsc#1228349 * bsc#1228786 * bsc#1229273 * bsc#1229553

* bsc#1225819 * bsc#1233712 Cross-References: * CVE-2023-52752

* bsc#1228573 * bsc#1229273 * bsc#1229553 * bsc#1232637 * bsc#1233712

* bsc#1229553 * bsc#1232637 * bsc#1233712 Cross-References:

* bsc#1210619 * bsc#1220537 * bsc#1223363 * bsc#1223683 * bsc#1225011

Several security issues were fixed in snapd.

Several security issues were fixed in libxmltok.

An issue has been found in gnuchess, a tool to play a game of chess, either against the user or against itself. The issue is related to arbitrary code execution via crafted PGN (Portable

Out of Bounds Memory Read/Write in libjxl. (CVE-2024-11403) Resource exhaustion via Stack overflow in libjxl. (CVE-2024-11498) References: – https://bugs.mageia.org/show_bug.cgi?id=33818

Avahi wide-area dns uses constant source port. (CVE-2024-52615) Avahi wide-area dns predictable transaction ids. (CVE-2024-52616) References: – https://bugs.mageia.org/show_bug.cgi?id=33829

Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the parse_die function. (CVE-2024-29645) References:

Command injection via RzBinInfo bclass due legacy code. (CVE-2022-1207) References: – https://bugs.mageia.org/show_bug.cgi?id=33895 – https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YNDCM5TGWRLSMIJ74ZI6LMNSCCH5DBPL/

Various security, performance, accuracy, and stability issues have been fixed.

work around debugedit bug to fix aarch64 builds xen-hypervisor %post doesn’t load all needed grub2 modules update to xen-4.19.1 which includes Deadlock in x86 HVM standard VGA handling [XSA-463, CVE-2024-45818] libxl leaks data to PVH guests via ACPI tables [XSA-464, CVE-2024-45819]

The fix for CVE-2024-6923 in the python3.9 source package which was released as part of a suite of updates in DLA 3980-1 [0] introduced safer processing of input in the email module to order to increase the security around email header injection attacks.

Several vulnerabilities were discovered in OpenAFS, an implementation of the AFS distributed filesystem, which may result in theft of credentials in Unix client PAGs (CVE-2024-10394), fileserver crashes and information leak on StoreACL/FetchACL (CVE-2024-10396) or buffer overflows in XDR

Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code. For Debian 11 bullseye, these problems have been fixed in version

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or privilege escalation.

Important: kernel-rt security update

Important: webkit2gtk3 security update

* jsc#PED-11136 Cross-References: * CVE-2024-12678 * CVE-2024-25131

* bsc#1233435 * bsc#1234663 * bsc#1234664 Cross-References:

* bsc#1234991 Cross-References: * CVE-2025-0237 * CVE-2025-0238

* bsc#1235029 Cross-References: * CVE-2024-56826

Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure.

xfpt could be made to crash or run programs if it opened a specially crafted file.

Thunderbird could be made to bypass security restrictions.

Several security issues were fixed in Firefox.

Updated to latest upstream (134.0)

* bsc#1082555 * bsc#1176081 * bsc#1206344 * bsc#1213034 * bsc#1218562

* bsc#1082555 * bsc#1157160 * bsc#1218644 * bsc#1221977 * bsc#1222364

Tinyproxy could be made to crash or run programs if it received specially crafted input.

* bsc#1233435 * bsc#1234663 * bsc#1234664 Cross-References: