Filtered by vendor Fedoraproject Subscriptions
Filtered by product Fedora Subscriptions
Total 5277 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-4059 2 Fedoraproject, Google 2 Fedora, Chrome 2025-03-27 6.5 Medium
Out of bounds read in V8 API in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to leak cross-site data via a crafted HTML page. (Chromium security severity: High)
CVE-2024-3157 2 Fedoraproject, Google 2 Fedora, Chrome 2025-03-27 8.1 High
Out of bounds memory access in Compositing in Google Chrome prior to 123.0.6312.122 allowed a remote attacker who had compromised the GPU process to potentially perform a sandbox escape via specific UI gestures. (Chromium security severity: High)
CVE-2024-31497 6 Fedoraproject, Filezilla-project, Putty and 3 more 6 Fedora, Filezilla Client, Putty and 3 more 2025-03-27 5.9 Medium
In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. This is especially important in a scenario where an adversary is able to read messages signed by PuTTY or Pageant. The required set of signed messages may be publicly readable because they are stored in a public Git service that supports use of SSH for commit signing, and the signatures were made by Pageant through an agent-forwarding mechanism. In other words, an adversary may already have enough signature information to compromise a victim's private key, even if there is no further use of vulnerable PuTTY versions. After a key compromise, an adversary may be able to conduct supply-chain attacks on software maintained in Git. A second, independent scenario is that the adversary is an operator of an SSH server to which the victim authenticates (for remote login or file copy), even though this server is not fully trusted by the victim, and the victim uses the same private key for SSH connections to other services operated by other entities. Here, the rogue server operator (who would otherwise have no way to determine the victim's private key) can derive the victim's private key, and then use it for unauthorized access to those other services. If the other services include Git services, then again it may be possible to conduct supply-chain attacks on software maintained in Git. This also affects, for example, FileZilla before 3.67.0, WinSCP before 6.3.3, TortoiseGit before 2.15.0.1, and TortoiseSVN through 1.14.6.
CVE-2023-47038 3 Fedoraproject, Perl, Redhat 5 Fedora, Perl, Enterprise Linux and 2 more 2025-03-27 7 High
A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.
CVE-2022-3560 3 Fedoraproject, Pesign Project, Redhat 7 Fedora, Pesign, Enterprise Linux and 4 more 2025-03-26 5.5 Medium
A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group. However, the script doesn't check for symbolic links. This could allow an attacker to gain access to privileged files and directories via a path traversal attack.
CVE-2024-2626 2 Fedoraproject, Google 2 Fedora, Chrome 2025-03-26 6.5 Medium
Out of bounds read in Swiftshader in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-38276 2 Fedoraproject, Moodle 2 Fedora, Moodle 2025-03-26 8.8 High
Incorrect CSRF token checks resulted in multiple CSRF risks.
CVE-2023-25193 3 Fedoraproject, Harfbuzz Project, Redhat 8 Fedora, Harfbuzz, Enterprise Linux and 5 more 2025-03-26 7.5 High
hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.
CVE-2022-1586 5 Debian, Fedoraproject, Netapp and 2 more 18 Debian Linux, Fedora, Active Iq Unified Manager and 15 more 2025-03-25 9.1 Critical
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.
CVE-2023-52429 2 Fedoraproject, Linux 2 Fedora, Linux Kernel 2025-03-25 5.5 Medium
dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX bytes, and crash, because of a missing check for struct dm_ioctl.target_count.
CVE-2022-46663 3 Fedoraproject, Gnu, Redhat 3 Fedora, Less, Enterprise Linux 2025-03-25 7.5 High
In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal.
CVE-2024-2886 2 Fedoraproject, Google 2 Fedora, Chrome 2025-03-22 7.5 High
Use after free in WebCodecs in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
CVE-2024-2173 2 Fedoraproject, Google 2 Fedora, Chrome 2025-03-22 6.8 Medium
Out of bounds memory access in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVE-2023-27320 2 Fedoraproject, Sudo Project 2 Fedora, Sudo 2025-03-22 7.2 High
Sudo before 1.9.13p2 has a double free in the per-command chroot feature.
CVE-2021-41773 4 Apache, Fedoraproject, Netapp and 1 more 4 Http Server, Fedora, Cloud Backup and 1 more 2025-03-22 7.5 High
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
CVE-2021-42013 4 Apache, Fedoraproject, Netapp and 1 more 6 Http Server, Fedora, Cloud Backup and 3 more 2025-03-22 9.8 Critical
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
CVE-2024-2408 3 Fedoraproject, Php, Redhat 3 Fedora, Php, Enterprise Linux 2025-03-21 5.9 Medium
The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable. PHP Windows builds for the versions 8.1.29, 8.2.20 and 8.3.8 and above include OpenSSL patches that fix the vulnerability.
CVE-2023-34410 4 Debian, Fedoraproject, Qt and 1 more 4 Debian Linux, Fedora, Qt and 1 more 2025-03-21 5.3 Medium
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consider whether the root of a chain is a configured CA certificate.
CVE-2020-14410 3 Debian, Fedoraproject, Libsdl 3 Debian Linux, Fedora, Simple Directmedia Layer 2025-03-20 5.4 Medium
SDL (Simple DirectMedia Layer) through 2.0.12 has a heap-based buffer over-read in Blit_3or4_to_3or4__inversed_rgb in video/SDL_blit_N.c via a crafted .BMP file.
CVE-2023-1194 3 Fedoraproject, Linux, Redhat 3 Fedora, Linux Kernel, Enterprise Linux 2025-03-20 7.1 High
An out-of-bounds (OOB) memory read flaw was found in parse_lease_state in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. When an attacker sends the CREATE command with a malformed payload to KSMBD, due to a missing check of `NameOffset` in the `parse_lease_state()` function, the `create_context` object can access invalid memory.