ISHACK AI BOT

Juniper Junos OS: 2025-01 Security Bulletin: Junos OS and Junos OS Evolved: On SRv6 enabled devices, an attacker sending a malformed BGP update can cause the rpd to crash (JSA92861) (CVE-2025-21593) Severity 6 CVSS (AV:A/AC:L/Au:N/C:N/I:N/A:C) Published 01/08/2025 Created 01/10/2025 Added 01/09/2025 Modified 01/28/2025 Description An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a Denial-of-Service (DoS). On devices with SRv6 (Segment Routing over IPv6) enabled, an attacker can send a malformed BGP UPDATE packet which will cause the rpd to crash and restart. Continued receipt of these UPDATE packets will cause a sustained DoS condition. This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.This issue affects Junos OS: *All versions before 21.2R3-S9, *from 21.4 before 21.4R3-S10, *from 22.2 before 22.2R3-S5, *from 22.3 before 22.3R3-S4, *from 22.4 before 22.4R3-S3, *from 23.2 before 23.2R2-S2, *from 23.4 before 23.4R2; and Junos OS Evolved: *All versions before 21.2R3-S9-EVO, *from 21.4-EVO before 21.4R3-S10-EVO, *from 22.2-EVO before 22.2R3-S5-EVO, *from 22.3-EVO before 22.3R3-S4-EVO, *from 22.4-EVO before 22.4R3-S3-EVO, *from 23.2-EVO before 23.2R2-S2-EVO, *from 23.4-EVO before 23.4R2-EVO. Solution(s) juniper-junos-os-upgrade-latest References https://attackerkb.com/topics/cve-2025-21593 CVE - 2025-21593 JSA92861

Juniper Junos OS: 2025-01 Security Bulletin: Junos OS and Junos OS Evolved: When BGP traceoptions are configured, receipt of malformed BGP packets causes RPD to crash (JSA92867) (CVE-2025-21598) Severity 8 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:C) Published 01/08/2025 Created 01/10/2025 Added 01/09/2025 Modified 01/30/2025 Description An Out-of-bounds Read vulnerability in Juniper Networks Junos OS and Junos OS Evolved's routing protocol daemon (rpd) allows an unauthenticated, network-based attacker to send malformed BGP packets to a device configured with packet receive trace options enabled to crash rpd. This issue affects: Junos OS: *from 21.2R3-S8 before 21.2R3-S9, *from 21.4R3-S7 before 21.4R3-S9, *from 22.2R3-S4 before 22.2R3-S5, *from 22.3R3-S2 before 22.3R3-S4, *from 22.4R3 before 22.4R3-S5, *from 23.2R2 before 23.2R2-S2, *from 23.4R1 before 23.4R2-S1, *from 24.2R1 before 24.2R1-S1, 24.2R2. Junos OS Evolved: *from 21.4R3-S7-EVO before 21.4R3-S9-EVO, *from 22.2R3-S4-EVO before 22.2R3-S5-EVO, *from 22.3R3-S2-EVO before 22.3R3-S4-EVO, *from 22.4R3-EVO before 22.4R3-S5-EVO, *from 23.2R2-EVO before 23.2R2-S2-EVO, *from 23.4R1-EVO before 23.4R2-S1-EVO, *from 24.2R1-EVO before 24.2R1-S2-EVO, 24.2R2-EVO. This issue requires a BGP session to be established. This issue can propagate and multiply through multiple ASes until reaching vulnerable devices. This issue affects iBGP and eBGP. This issue affects IPv4 and IPv6. An indicator of compromise may be the presence of malformed update messages in a neighboring AS which is unaffected by this issue: For example, by issuing the command on the neighboring device: show log messages Reviewing for similar messages from devices within proximity to each other may indicate this malformed packet is propagating: rpd[<pid>]: Received malformed update from <IP address> (External AS <AS#>) and rpd[<pid>]: Malformed Attribute Solution(s) juniper-junos-os-upgrade-latest References https://attackerkb.com/topics/cve-2025-21598 CVE - 2025-21598 JSA92867

Debian: CVE-2024-56770: linux -- security update Severity 5 CVSS (AV:L/AC:L/Au:S/C:N/I:N/A:C) Published 01/08/2025 Created 01/14/2025 Added 01/13/2025 Modified 01/30/2025 Description In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: account for backlog updates from child qdisc In general, 'qlen' of any classful qdisc should keep track of the number of packets that the qdisc itself and all of its children holds. In case of netem, 'qlen' only accounts for the packets in its internal tfifo. When netem is used with a child qdisc, the child qdisc can use 'qdisc_tree_reduce_backlog' to inform its parent, netem, about created or dropped SKBs. This function updates 'qlen' and the backlog statistics of netem, but netem does not account for changes made by a child qdisc. 'qlen' then indicates the wrong number of packets in the tfifo. If a child qdisc creates new SKBs during enqueue and informs its parent about this, netem's 'qlen' value is increased. When netem dequeues the newly created SKBs from the child, the 'qlen' in netem is not updated. If 'qlen' reaches the configured sch->limit, the enqueue function stops working, even though the tfifo is not full. Reproduce the bug: Ensure that the sender machine has GSO enabled. Configure netem as root qdisc and tbf as its child on the outgoing interface of the machine as follows: $ tc qdisc add dev <oif> root handle 1: netem delay 100ms limit 100 $ tc qdisc add dev <oif> parent 1:0 tbf rate 50Mbit burst 1542 latency 50ms Send bulk TCP traffic out via this interface, e.g., by running an iPerf3 client on the machine. Check the qdisc statistics: $ tc -s qdisc show dev <oif> Statistics after 10s of iPerf3 TCP test before the fix (note that netem's backlog > limit, netem stopped accepting packets): qdisc netem 1: root refcnt 2 limit 1000 delay 100ms Sent 2767766 bytes 1848 pkt (dropped 652, overlimits 0 requeues 0) backlog 4294528236b 1155p requeues 0 qdisc tbf 10: parent 1:1 rate 50Mbit burst 1537b lat 50ms Sent 2767766 bytes 1848 pkt (dropped 327, overlimits 7601 requeues 0) backlog 0b 0p requeues 0 Statistics after the fix: qdisc netem 1: root refcnt 2 limit 1000 delay 100ms Sent 37766372 bytes 24974 pkt (dropped 9, overlimits 0 requeues 0) backlog 0b 0p requeues 0 qdisc tbf 10: parent 1:1 rate 50Mbit burst 1537b lat 50ms Sent 37766372 bytes 24974 pkt (dropped 327, overlimits 96017 requeues 0) backlog 0b 0p requeues 0 tbf segments the GSO SKBs (tbf_segment) and updates the netem's 'qlen'. The interface fully stops transferring packets and "locks". In this case, the child qdisc and tfifo are empty, but 'qlen' indicates the tfifo is at its limit and no more packets are accepted. This patch adds a counter for the entries in the tfifo. Netem's 'qlen' is only decreased when a packet is returned by its dequeue function, and not during enqueuing into the child qdisc. External updates to 'qlen' are thus accounted for and only the behavior of the backlog statistics changes. As in other qdiscs, 'qlen' then keeps track ofhow many packets are held in netem and all of its children. As before, sch->limit remains as the maximum number of packets in the tfifo. The same applies to netem's backlog statistics. Solution(s) debian-upgrade-linux References https://attackerkb.com/topics/cve-2024-56770 CVE - 2024-56770

VMware Photon OS: CVE-2024-56770 Severity 5 CVSS (AV:L/AC:L/Au:S/C:N/I:N/A:C) Published 01/08/2025 Created 01/21/2025 Added 01/20/2025 Modified 02/04/2025 Description In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: account for backlog updates from child qdisc In general, 'qlen' of any classful qdisc should keep track of the number of packets that the qdisc itself and all of its children holds. In case of netem, 'qlen' only accounts for the packets in its internal tfifo. When netem is used with a child qdisc, the child qdisc can use 'qdisc_tree_reduce_backlog' to inform its parent, netem, about created or dropped SKBs. This function updates 'qlen' and the backlog statistics of netem, but netem does not account for changes made by a child qdisc. 'qlen' then indicates the wrong number of packets in the tfifo. If a child qdisc creates new SKBs during enqueue and informs its parent about this, netem's 'qlen' value is increased. When netem dequeues the newly created SKBs from the child, the 'qlen' in netem is not updated. If 'qlen' reaches the configured sch->limit, the enqueue function stops working, even though the tfifo is not full. Reproduce the bug: Ensure that the sender machine has GSO enabled. Configure netem as root qdisc and tbf as its child on the outgoing interface of the machine as follows: $ tc qdisc add dev <oif> root handle 1: netem delay 100ms limit 100 $ tc qdisc add dev <oif> parent 1:0 tbf rate 50Mbit burst 1542 latency 50ms Send bulk TCP traffic out via this interface, e.g., by running an iPerf3 client on the machine. Check the qdisc statistics: $ tc -s qdisc show dev <oif> Statistics after 10s of iPerf3 TCP test before the fix (note that netem's backlog > limit, netem stopped accepting packets): qdisc netem 1: root refcnt 2 limit 1000 delay 100ms Sent 2767766 bytes 1848 pkt (dropped 652, overlimits 0 requeues 0) backlog 4294528236b 1155p requeues 0 qdisc tbf 10: parent 1:1 rate 50Mbit burst 1537b lat 50ms Sent 2767766 bytes 1848 pkt (dropped 327, overlimits 7601 requeues 0) backlog 0b 0p requeues 0 Statistics after the fix: qdisc netem 1: root refcnt 2 limit 1000 delay 100ms Sent 37766372 bytes 24974 pkt (dropped 9, overlimits 0 requeues 0) backlog 0b 0p requeues 0 qdisc tbf 10: parent 1:1 rate 50Mbit burst 1537b lat 50ms Sent 37766372 bytes 24974 pkt (dropped 327, overlimits 96017 requeues 0) backlog 0b 0p requeues 0 tbf segments the GSO SKBs (tbf_segment) and updates the netem's 'qlen'. The interface fully stops transferring packets and "locks". In this case, the child qdisc and tfifo are empty, but 'qlen' indicates the tfifo is at its limit and no more packets are accepted. This patch adds a counter for the entries in the tfifo. Netem's 'qlen' is only decreased when a packet is returned by its dequeue function, and not during enqueuing into the child qdisc. External updates to 'qlen' are thus accounted for and only the behavior of the backlog statistics changes. As in other qdiscs, 'qlen' then keeps track ofhow many packets are held in netem and all of its children. As before, sch->limit remains as the maximum number of packets in the tfifo. The same applies to netem's backlog statistics. Solution(s) vmware-photon_os_update_tdnf References https://attackerkb.com/topics/cve-2024-56770 CVE - 2024-56770

SUSE: CVE-2025-22130: SUSE Linux Security Advisory Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 01/08/2025 Created 01/14/2025 Added 01/13/2025 Modified 01/13/2025 Description Soft Serve is a self-hostable Git server for the command line. Prior to 0.8.2 , a path traversal attack allows existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without explicitly giving them permissions. This is patched in v0.8.2. Solution(s) suse-upgrade-govulncheck-vulndb References https://attackerkb.com/topics/cve-2025-22130 CVE - 2025-22130

Juniper Junos OS: 2025-01 Security Bulletin: Junos OS: SRX Series: Low privileged user able to access highly sensitive information on file system (JSA92860) (CVE-2025-21592) Severity 5 CVSS (AV:L/AC:L/Au:S/C:C/I:N/A:N) Published 01/08/2025 Created 01/10/2025 Added 01/09/2025 Modified 01/30/2025 Description An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the command-line interface (CLI) of Juniper Networks Junos OS on SRX Series devices allows a local, low-privileged user with access to the Junos CLI to view the contents of sensitive files on the file system. Through the execution of either 'show services advanced-anti-malware' or 'show services security-intelligence' command, a user with limited permissions (e.g., a low privilege login class user) can access protected files that should not be accessible to the user. These files may contain sensitive information that can be used to cause further impact to the system. This issue affects Junos OS SRX Series: *All versions before 21.4R3-S8, *from 22.2 before 22.2R3-S5, *from 22.3 before 22.3R3-S3, *from 22.4 before 22.4R3-S2, *from 23.2 before 23.2R2-S1, *from 23.4 before 23.4R2. Solution(s) juniper-junos-os-upgrade-latest References https://attackerkb.com/topics/cve-2025-21592 CVE - 2025-21592 JSA92860

Debian: CVE-2024-56779: linux -- security update Severity 5 CVSS (AV:L/AC:L/Au:S/C:N/I:N/A:C) Published 01/08/2025 Created 01/14/2025 Added 01/13/2025 Modified 01/30/2025 Description In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur The action force umount(umount -f) will attempt to kill all rpc_task even umount operation may ultimately fail if some files remain open. Consequently, if an action attempts to open a file, it can potentially send two rpc_task to nfs server. NFS CLIENT thread1 thread2 open("file") ... nfs4_do_open _nfs4_do_open _nfs4_open_and_get_state _nfs4_proc_open nfs4_run_open_task /* rpc_task1 */ rpc_run_task rpc_wait_for_completion_task umount -f nfs_umount_begin rpc_killall_tasks rpc_signal_task rpc_task1 been wakeup and return -512 _nfs4_do_open // while loop ... nfs4_run_open_task /* rpc_task2 */ rpc_run_task rpc_wait_for_completion_task While processing an open request, nfsd will first attempt to find or allocate an nfs4_openowner. If it finds an nfs4_openowner that is not marked as NFS4_OO_CONFIRMED, this nfs4_openowner will released. Since two rpc_task can attempt to open the same file simultaneously from the client to server, and because two instances of nfsd can run concurrently, this situation can lead to lots of memory leak. Additionally, when we echo 0 to /proc/fs/nfsd/threads, warning will be triggered. NFS SERVER nfsd1nfsd2 echo 0 > /proc/fs/nfsd/threads nfsd4_open nfsd4_process_open1 find_or_alloc_open_stateowner // alloc oo1, stateid1 nfsd4_open nfsd4_process_open1 find_or_alloc_open_stateowner // find oo1, without NFS4_OO_CONFIRMED release_openowner unhash_openowner_locked list_del_init(&oo->oo_perclient) // cannot find this oo // from client, LEAK!!! alloc_stateowner // alloc oo2 nfsd4_process_open2 init_open_stateid // associate oo1 // with stateid1, stateid1 LEAK!!! nfs4_get_vfs_file // alloc nfsd_file1 and nfsd_file_mark1 // all LEAK!!! nfsd4_process_open2 ... write_threads ... nfsd_destroy_serv nfsd_shutdown_net nfs4_state_shutdown_net nfs4_state_destroy_net destroy_client __destroy_client // won't find oo1!!! nfsd_shutdown_generic nfsd_file_cache_shutdown kmem_cache_destroy for nfsd_file_slab and nfsd_file_mark_slab // bark since nfsd_file1 // and nfsd_file_mark1 // still alive ======================================================================= BUG nfsd_file (Not tainted): Objects remaining in nfsd_file on __kmem_cache_shutdown() ----------------------------------------------------------------------- Slab 0xffd4000004438a80 objects=34 used=1 fp=0xff11000110e2ad28 flags=0x17ffffc0000240(workingset|head|node=0|zone=2|lastcpupid=0x1fffff) CPU: 4 UID: 0 PID: 757 Comm: sh Not tainted 6.12.0-rc6+ #19 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dum ---truncated--- Solution(s) debian-upgrade-linux References https://attackerkb.com/topics/cve-2024-56779 CVE - 2024-56779

Debian: CVE-2024-56778: linux -- security update Severity 5 CVSS (AV:L/AC:L/Au:S/C:N/I:N/A:C) Published 01/08/2025 Created 01/14/2025 Added 01/13/2025 Modified 01/30/2025 Description In the Linux kernel, the following vulnerability has been resolved: drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' in case of the failure. Solution(s) debian-upgrade-linux References https://attackerkb.com/topics/cve-2024-56778 CVE - 2024-56778

Joomla!: [20250102] - Core - XSS vector in the id attribute of menu lists (CVE-2024-40748) Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 01/08/2025 Created 01/09/2025 Added 01/08/2025 Modified 01/09/2025 Description Lack of output escaping in the id attribute of menu lists. Solution(s) joomla-upgrade-3_10_20 joomla-upgrade-4_4_10 joomla-upgrade-5_2_3 References https://attackerkb.com/topics/cve-2024-40748 CVE - 2024-40748 http://developer.joomla.org/security-centre/955-20250102-core-xss-vector-in-the-id-attribute-of-menu-lists.html

Debian: CVE-2024-56777: linux -- security update Severity 5 CVSS (AV:L/AC:L/Au:S/C:N/I:N/A:C) Published 01/08/2025 Created 01/14/2025 Added 01/13/2025 Modified 01/30/2025 Description In the Linux kernel, the following vulnerability has been resolved: drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' in case of the failure. Solution(s) debian-upgrade-linux References https://attackerkb.com/topics/cve-2024-56777 CVE - 2024-56777

Security Advisory Ivanti Connect Secure, Policy Secure & ZTA Gateways (CVE-2025-0282, CVE-2025-0283) Severity 8 CVSS (AV:N/AC:H/Au:N/C:C/I:C/A:C) Published 01/08/2025 Created 01/09/2025 Added 01/08/2025 Modified 01/09/2025 Description A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution. Solution(s) pulse-secure-pulse-connect-secure-upgrade-22_7r2_5 References https://attackerkb.com/topics/cve-2025-0282 CVE - 2025-0282 https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283?language=en_US https://www.rapid7.com/blog/post/2025/01/08/etr-cve-2025-0282-ivanti-connect-secure-zero-day-exploited-in-the-wild/

FreeBSD: VID-2BFDE261-CDF2-11EF-B6B2-2CF05DA270F3 (CVE-2024-12431): Gitlab -- Vulnerabilities Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 01/08/2025 Created 01/10/2025 Added 01/09/2025 Modified 01/09/2025 Description An issue was discovered in GitLab CE/EE affecting all versions starting from 15.5 before 17.5.5, 17.6 before 17.6.3, and 17.7 before 17.7.1, in which unauthorized users could manipulate the status of issues in public projects. Solution(s) freebsd-upgrade-package-gitlab-ce freebsd-upgrade-package-gitlab-ee References CVE-2024-12431

Red Hat: CVE-2025-0237: firefox: WebChannel APIs susceptible to confused deputy attack (Multiple Advisories) Severity 7 CVSS (AV:N/AC:H/Au:N/C:C/I:C/A:N) Published 01/07/2025 Created 01/11/2025 Added 01/10/2025 Modified 01/22/2025 Description The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6. Solution(s) redhat-upgrade-firefox redhat-upgrade-firefox-debuginfo redhat-upgrade-firefox-debugsource redhat-upgrade-firefox-x11 redhat-upgrade-thunderbird redhat-upgrade-thunderbird-debuginfo redhat-upgrade-thunderbird-debugsource References CVE-2025-0237 RHSA-2025:0080 RHSA-2025:0135 RHSA-2025:0137 RHSA-2025:0138 RHSA-2025:0144 RHSA-2025:0281 RHSA-2025:0284 View more

Ubuntu: USN-7228-1 (CVE-2024-12425): LibreOffice vulnerabilities Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 01/07/2025 Created 01/31/2025 Added 01/30/2025 Modified 01/30/2025 Description Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal. An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files. This issue affects LibreOffice: from 24.8 before < 24.8.4. Solution(s) ubuntu-upgrade-libreoffice References https://attackerkb.com/topics/cve-2024-12425 CVE - 2024-12425 USN-7228-1

FreeBSD: VID-2BFDE261-CDF2-11EF-B6B2-2CF05DA270F3 (CVE-2025-0194): Gitlab -- Vulnerabilities Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 01/08/2025 Created 01/10/2025 Added 01/09/2025 Modified 01/09/2025 Description An issue was discovered in GitLab CE/EE affecting all versions starting from 17.4 prior to 17.5.1, starting from 17.6 prior to 17.6.1, and starting from 17.7 prior to 17.7.1. Under certain conditions, access tokens may have been logged when API requests were made in a specific manner. Solution(s) freebsd-upgrade-package-gitlab-ce freebsd-upgrade-package-gitlab-ee References CVE-2025-0194

Red Hat: CVE-2025-0239: firefox: Alt-Svc ALPN validation failure when redirected (Multiple Advisories) Severity 6 CVSS (AV:N/AC:L/Au:N/C:P/I:P/A:N) Published 01/07/2025 Created 01/11/2025 Added 01/10/2025 Modified 01/22/2025 Description When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6. Solution(s) redhat-upgrade-firefox redhat-upgrade-firefox-debuginfo redhat-upgrade-firefox-debugsource redhat-upgrade-firefox-x11 redhat-upgrade-thunderbird redhat-upgrade-thunderbird-debuginfo redhat-upgrade-thunderbird-debugsource References CVE-2025-0239 RHSA-2025:0080 RHSA-2025:0135 RHSA-2025:0137 RHSA-2025:0138 RHSA-2025:0144 RHSA-2025:0281 RHSA-2025:0284 View more

Red Hat: CVE-2025-0238: firefox: Use-after-free when breaking lines in text (Multiple Advisories) Severity 8 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:C) Published 01/07/2025 Created 01/11/2025 Added 01/10/2025 Modified 01/22/2025 Description Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Firefox ESR < 115.19, Thunderbird < 134, and Thunderbird < 128.6. Solution(s) redhat-upgrade-firefox redhat-upgrade-firefox-debuginfo redhat-upgrade-firefox-debugsource redhat-upgrade-firefox-x11 redhat-upgrade-thunderbird redhat-upgrade-thunderbird-debuginfo redhat-upgrade-thunderbird-debugsource References CVE-2025-0238 RHSA-2025:0080 RHSA-2025:0135 RHSA-2025:0137 RHSA-2025:0138 RHSA-2025:0144 RHSA-2025:0281 RHSA-2025:0284 View more

Debian: CVE-2025-0241: firefox-esr, thunderbird -- security update Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 01/07/2025 Created 01/11/2025 Added 01/10/2025 Modified 01/15/2025 Description When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6. Solution(s) debian-upgrade-firefox-esr debian-upgrade-thunderbird References https://attackerkb.com/topics/cve-2025-0241 CVE - 2025-0241 DSA-5839-1

Debian: CVE-2024-12425: libreoffice -- security update Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 01/07/2025 Created 01/21/2025 Added 01/20/2025 Modified 01/21/2025 Description Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal. An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files. This issue affects LibreOffice: from 24.8 before < 24.8.4. Solution(s) debian-upgrade-libreoffice References https://attackerkb.com/topics/cve-2024-12425 CVE - 2024-12425 DLA-4020-1

Gentoo Linux: CVE-2025-0238: Mozilla Firefox: Multiple Vulnerabilities Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 01/07/2025 Created 01/25/2025 Added 01/24/2025 Modified 01/24/2025 Description Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Firefox ESR < 115.19, Thunderbird < 134, and Thunderbird < 128.6. Solution(s) gentoo-linux-upgrade-www-client-firefox gentoo-linux-upgrade-www-client-firefox-bin References https://attackerkb.com/topics/cve-2025-0238 CVE - 2025-0238 202501-10

MFSA2025-01 Firefox: Security Vulnerabilities fixed in Firefox 134 (CVE-2025-0240) Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 01/07/2025 Created 01/09/2025 Added 01/08/2025 Modified 02/06/2025 Description Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6. Solution(s) mozilla-firefox-upgrade-134_0 References https://attackerkb.com/topics/cve-2025-0240 CVE - 2025-0240 http://www.mozilla.org/security/announce/2025/mfsa2025-01.html

MFSA2025-01 Firefox: Security Vulnerabilities fixed in Firefox 134 (CVE-2025-0242) Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 01/07/2025 Created 01/09/2025 Added 01/08/2025 Modified 01/15/2025 Description Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Firefox ESR < 115.19, Thunderbird < 134, and Thunderbird < 128.6. Solution(s) mozilla-firefox-upgrade-134_0 References https://attackerkb.com/topics/cve-2025-0242 CVE - 2025-0242 http://www.mozilla.org/security/announce/2025/mfsa2025-01.html

Rocky Linux: CVE-2025-0243: thunderbird (Multiple Advisories) Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 01/07/2025 Created 01/14/2025 Added 01/13/2025 Modified 01/20/2025 Description Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6. Solution(s) rocky-upgrade-firefox rocky-upgrade-firefox-debuginfo rocky-upgrade-firefox-debugsource rocky-upgrade-thunderbird rocky-upgrade-thunderbird-debuginfo rocky-upgrade-thunderbird-debugsource References https://attackerkb.com/topics/cve-2025-0243 CVE - 2025-0243 https://errata.rockylinux.org/RLSA-2025:0144 https://errata.rockylinux.org/RLSA-2025:0281

Debian: CVE-2024-12426: libreoffice -- security update Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 01/07/2025 Created 01/21/2025 Added 01/20/2025 Modified 01/21/2025 Description Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice. URLs could be constructed which expanded environmental variables or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. This issue affects LibreOffice: from 24.8 before < 24.8.4. Solution(s) debian-upgrade-libreoffice References https://attackerkb.com/topics/cve-2024-12426 CVE - 2024-12426 DLA-4020-1

MFSA2025-01 Firefox: Security Vulnerabilities fixed in Firefox 134 (CVE-2025-0245) Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 01/07/2025 Created 01/09/2025 Added 01/08/2025 Modified 01/09/2025 Description Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed. This vulnerability affects Firefox < 134. Solution(s) mozilla-firefox-upgrade-134_0 References https://attackerkb.com/topics/cve-2025-0245 CVE - 2025-0245 http://www.mozilla.org/security/announce/2025/mfsa2025-01.html