Fedoraproject CVEs — known vulnerabilities

Fedora HIGH 8.6

CVE-2024-25713

yyjson through 0.8.0 has a double free, leading to remote code execution in some cases, because the pool_free function lacks loop checks. (pool_free …

Fix: after 0.8.0

Fix from $1,950 2024-02-29

Fedora MEDIUM 6.1

CVE-2024-27285

YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) a…

Fix: 0.9.36+

Fix from $1,600 2024-02-28

Fedora HIGH 7.5

CVE-2024-27507

libLAS 1.8.1 contains a memory leak vulnerability in /libLAS/apps/ts2las.cpp.

No fix yet

Fix from $1,950 2024-02-27

Fedora HIGH 7.5

CVE-2024-25711

diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclos…

Fix: 256+

Fix from $1,950 2024-02-27

Fedora HIGH 8.1

CVE-2024-23839

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, specially craf…

Fix: 7.0.3+

Fix from $1,950 2024-02-26

Fedora MEDIUM 5.3

CVE-2024-24568

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, the rules insp…

Fix: 7.0.3+

Fix from $1,600 2024-02-26

Fedora HIGH 7.5

CVE-2024-23835

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.3, excess…

Fix: 7.0.3+

Fix from $1,950 2024-02-26

Fedora HIGH 7.5

CVE-2024-23836

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 6.0.16 and 7.…

Fix: 6.0.16 / 7.0.3+

Fix from $1,950 2024-02-26

Fedora HIGH 7.5

CVE-2024-23837

LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of se…

Fix: 0.5.46+

Fix from $1,950 2024-02-26

Fedora HIGH 7.5

CVE-2024-1622

Due to a mistake in error checking, Routinator will terminate when an incoming RTR connection is reset by the peer too quickly after opening.

Fix: 0.13.2+

Fix from $1,950 2024-02-26

Fedora MEDIUM 5.3

CVE-2024-21501

Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allo…

Fix: 2.12.1+

Fix from $1,600 2024-02-24

Fedora CRITICAL 9.1

CVE-2024-27319

Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions have an o…

Fix: 1.16.0+

Fix from $2,300 2024-02-23

Fedora HIGH 7.5

CVE-2024-27318

Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can hav…

Fix: 1.16.0+

Fix from $1,950 2024-02-23

Fedora MEDIUM 5.5

CVE-2024-25629

c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc…

Fix: 1.27.0+

Fix from $1,600 2024-02-23

Fedora HIGH 7.5

CVE-2023-3966

A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invali…

Fix: 3.1.0+

Fix from $1,950 2024-02-22

Fedora HIGH 7.5

CVE-2024-24476

A buffer overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the pan/addr_resolv.c, and ws_manuf_lookup_str(…

Fix: 4.2.0+

Fix from $1,950 2024-02-21

Fedora CRITICAL 9.8

CVE-2024-23809

A double-free vulnerability exists in the BrainVision ASCII Header Parsing functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0…

No fix yet