Fedora (Fedoraproject) - vulnerabilities (CVEs)

5368 CVEs, 0 in the last 30 days, 39 known versions, newest CVE from 2026-06-13. Vendor: Fedoraproject.

CVEs of Fedora

CVE-2026-54230 - CVSS 7.8 (high), 2026-06-13: A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell…
CVE-2026-54231 - CVSS 5.5 (medium), 2026-06-13: A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log…
CVE-2026-35093 - CVSS 8.8 (high), 2026-04-01: A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can…
CVE-2026-35094 - CVSS 5.5 (medium), 2026-04-01: A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability.…
CVE-2023-4134 - CVSS 5.5 (medium), 2024-11-14: A use-after-free vulnerability was found in the cyttsp4_core driver in the Linux kernel. This issue occurs in the device cleanup routine due to a possible…
CVE-2024-3056 - CVSS 7.7 (high), 2024-08-02: A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, when configured to share the same IPC with at least…
CVE-2024-6290 - CVSS 8.8 (high), 2024-06-24: Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
CVE-2024-6291 - CVSS 8.8 (high), 2024-06-24: Use after free in Swiftshader in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…
CVE-2024-6292 - CVSS 8.8 (high), 2024-06-24: Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
CVE-2024-6293 - CVSS 8.8 (high), 2024-06-24: Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
CVE-2024-38276 - CVSS 8.8 (high), 2024-06-18: Incorrect CSRF token checks resulted in multiple CSRF risks.
CVE-2024-38277 - CVSS 5.4 (medium), 2024-06-18: A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.
CVE-2024-38273 - CVSS 5.4 (medium), 2024-06-18: Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.
CVE-2024-38274 - CVSS 6.1 (medium), 2024-06-18: Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.
CVE-2024-5841 - CVSS 8.8 (high), 2024-06-11: Use after free in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
CVE-2024-5842 - CVSS 8.8 (high), 2024-06-11: Use after free in Browser UI in Google Chrome prior to 126.0.6478.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to…
CVE-2024-5843 - CVSS 8.8 (high), 2024-06-11: Inappropriate implementation in Downloads in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to obfuscate security UI via a malicious file.…
CVE-2024-5844 - CVSS 8.8 (high), 2024-06-11: Heap buffer overflow in Tab Strip in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML…
CVE-2024-5845 - CVSS 8.8 (high), 2024-06-11: Use after free in Audio in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.…
CVE-2024-5846 - CVSS 8.8 (high), 2024-06-11: Use after free in PDFium in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.…
CVE-2024-5847 - CVSS 8.8 (high), 2024-06-11: Use after free in PDFium in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.…
CVE-2024-5830 - CVSS 8.8 (high), 2024-06-11: Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.…
CVE-2024-5831 - CVSS 8.8 (high), 2024-06-11: Use after free in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
CVE-2024-5832 - CVSS 8.8 (high), 2024-06-11: Use after free in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
CVE-2024-5833 - CVSS 8.8 (high), 2024-06-11: Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML…
CVE-2024-5834 - CVSS 8.8 (high), 2024-06-11: Inappropriate implementation in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to execute arbitrary code via a crafted HTML page.…
CVE-2024-5835 - CVSS 8.8 (high), 2024-06-11: Heap buffer overflow in Tab Groups in Google Chrome prior to 126.0.6478.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to…
CVE-2024-5836 - CVSS 8.8 (high), 2024-06-11: Inappropriate Implementation in DevTools in Google Chrome prior to 126.0.6478.54 allowed an attacker who convinced a user to install a malicious extension to…
CVE-2024-5837 - CVSS 8.8 (high), 2024-06-11: Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML…
CVE-2024-5838 - CVSS 8.8 (high), 2024-06-11: Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.…
CVE-2024-5839 - CVSS 8.8 (high), 2024-06-11: Inappropriate Implementation in Memory Allocator in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via…
CVE-2024-5840 - CVSS 6.5 (medium), 2024-06-11: Policy bypass in CORS in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to bypass discretionary access control via a crafted HTML page.…
CVE-2024-35241 - CVSS 8.8 (high), 2024-06-10: Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages…
CVE-2024-35242 - CVSS 8.8 (high), 2024-06-10: Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg…
CVE-2024-2408 - CVSS 5.9 (medium), 2024-06-09: The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless…
CVE-2024-4577 - CVSS 9.8 (critical), 2024-06-09: In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain…
CVE-2024-5458 - CVSS 5.3 (medium), 2024-06-09: In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when…
CVE-2024-5585 - CVSS 8.8 (high), 2024-06-09: In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing…
CVE-2024-34006 - CVSS 4.3 (medium), 2024-05-31: The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.
CVE-2024-5493 - CVSS 8.8 (high), 2024-05-30: Heap buffer overflow in WebRTC in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…
CVE-2024-5494 - CVSS 8.8 (high), 2024-05-30: Use after free in Dawn in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
CVE-2024-5495 - CVSS 8.8 (high), 2024-05-30: Use after free in Dawn in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
CVE-2024-5496 - CVSS 8.8 (high), 2024-05-30: Use after free in Media Session in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted…
CVE-2024-5497 - CVSS 8.8 (high), 2024-05-30: Out of bounds memory access in Browser UI in Google Chrome prior to 125.0.6422.141 allowed a remote attacker who convinced a user to engage in specific UI…
CVE-2024-5498 - CVSS 8.8 (high), 2024-05-30: Use after free in Presentation API in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially exploit heap corruption via a crafted…
CVE-2024-5499 - CVSS 8.8 (high), 2024-05-30: Out of bounds write in Streams API in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted…
CVE-2024-32760 - CVSS 6.5 (medium), 2024-05-29: When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to…
CVE-2024-34161 - CVSS 5.3 (medium), 2024-05-29: When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or…
CVE-2024-35200 - CVSS 5.3 (medium), 2024-05-29: When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate.
CVE-2024-31079 - CVSS 4.8 (medium), 2024-05-29: When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or…
CVE-2024-5274 - CVSS 9.6 (critical), 2024-05-28: Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.…
CVE-2024-5159 - CVSS 8.8 (high), 2024-05-22: Heap buffer overflow in ANGLE in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML…
CVE-2024-5160 - CVSS 8.8 (high), 2024-05-22: Heap buffer overflow in Dawn in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML…
CVE-2024-5157 - CVSS 8.8 (high), 2024-05-22: Use after free in Scheduling in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML…
CVE-2024-5158 - CVSS 8.8 (high), 2024-05-22: Type Confusion in V8 in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to potentially perform arbitrary read/write via a crafted HTML page.…
CVE-2024-35949 - CVSS 7.8 (high), 2024-05-20: In the Linux kernel, the following vulnerability has been resolved: btrfs: make sure that WRITTEN is set on all metadata blocks We previously would call…
CVE-2024-35947 - CVSS 5.5 (medium), 2024-05-19: In the Linux kernel, the following vulnerability has been resolved: dyndbg: fix old BUG_ON in >control parser Fix a BUG_ON from 2009. Even if it looks…
CVE-2024-36048 - CVSS 9.8 (critical), 2024-05-18: QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1…
CVE-2023-46842 - CVSS 6.5 (medium), 2024-05-16: Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other modes. This in particular means that they may set registers used to pass…
CVE-2024-31142 - CVSS 7.5 (high), 2024-05-16: Because of a logical error in XSA-407 (Branch Type Confusion), the mitigation is not applied properly when it is intended to be used. XSA-434 (Speculative…
CVE-2024-4947 - CVSS 9.6 (critical), 2024-05-15: Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.…
CVE-2024-4948 - CVSS 8.8 (high), 2024-05-15: Use after free in Dawn in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
CVE-2024-4949 - CVSS 9.6 (critical), 2024-05-15: Use after free in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
CVE-2024-4950 - CVSS 6.5 (medium), 2024-05-15: Inappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a remote attacker who convinced a user to engage in specific UI…
CVE-2024-3044 - CVSS 6.5 (medium), 2024-05-14: Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will…
CVE-2024-32465 - CVSS 7.8 (high), 2024-05-14: Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with `git clone…
CVE-2024-32021 - CVSS 7.1 (high), 2024-05-14: Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that…
CVE-2024-32020 - CVSS 3.9 (low), 2024-05-14: Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, local clones may end up hardlinking files into…
CVE-2024-32004 - CVSS 8.2 (high), 2024-05-14: Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in…
CVE-2024-4761 - CVSS 8.8 (high), 2024-05-14: Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.…
CVE-2024-4855 - CVSS 5.5 (medium), 2024-05-14: Use after free issue in editcap could cause denial of service via crafted capture file
CVE-2024-4853 - CVSS 5.5 (medium), 2024-05-14: Memory handling issue in editcap could cause denial of service via crafted capture file
CVE-2024-4854 - CVSS 7.5 (high), 2024-05-14: MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection…
CVE-2024-4671 - CVSS 9.6 (critical), 2024-05-14: Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a…
CVE-2024-34340 - CVSS 9.1 (critical), 2024-05-14: Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their…
CVE-2024-31459 - CVSS 8.1 (high), 2024-05-14: Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, there is a file inclusion issue in the `lib/plugin.php`…
CVE-2024-31460 - CVSS 8.8 (high), 2024-05-14: Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `automation_tree_rules.php` is…
CVE-2024-31458 - CVSS 8 (high), 2024-05-14: Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in `form_save()` function in…
CVE-2024-31445 - CVSS 8.8 (high), 2024-05-14: Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in…
CVE-2024-31443 - CVSS 5.7 (medium), 2024-05-14: Cacti provides an operational monitoring and fault management framework. Prior to 1.2.27, some of the data stored in `form_save()` function in…
CVE-2024-31444 - CVSS 5.4 (medium), 2024-05-14: Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in…
CVE-2024-29894 - CVSS 5.4 (medium), 2024-05-14: Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 contain a residual cross-site scripting…
CVE-2024-27834 - CVSS 8.1 (high), 2024-05-14: The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5,…
CVE-2024-27400 - CVSS 7.8 (high), 2024-05-14: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2 This reverts drm/amdgpu:…
CVE-2024-27401 - CVSS 7.8 (high), 2024-05-14: In the Linux kernel, the following vulnerability has been resolved: firewire: nosy: ensure user_length is taken into account when fetching packet contents…
CVE-2024-27398 - CVSS 8 (high), 2024-05-14: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout When the sco connection is…
CVE-2024-27399 - CVSS 5.5 (medium), 2024-05-14: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout There is a race condition…
CVE-2024-25641 - CVSS 9.1 (critical), 2024-05-14: Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through…
CVE-2024-4558 - CVSS 9.6 (critical), 2024-05-07: Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
CVE-2024-4559 - CVSS 7.5 (high), 2024-05-07: Heap buffer overflow in WebAudio in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…
CVE-2024-34397 - CVSS 5.2 (medium), 2024-05-07: An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted…
CVE-2024-34064 - CVSS 5.4 (medium), 2024-05-06: Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML…
CVE-2024-34069 - CVSS 7.5 (high), 2024-05-06: Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's…
CVE-2024-34500 - CVSS 6.1 (medium), 2024-05-05: An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an…
CVE-2024-34502 - CVSS 9.8 (critical), 2024-05-05: An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will…
CVE-2024-34506 - CVSS 7.5 (high), 2024-05-05: An issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. If a user with…
CVE-2024-34507 - CVSS 7.4 (high), 2024-05-05: An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. XSS can…
CVE-2024-34402 - CVSS 8.6 (high), 2024-05-03: An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer…
CVE-2024-34403 - CVSS 5.9 (medium), 2024-05-03: An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.
CVE-2024-4140 - CVSS 7.5 (high), 2024-05-02: An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages.…