April 2024 - Epel-packagers-sig - Fedora mailing-lists

[Bug 2255322] New: asterisk: PJSIP logging allows attacker to inject fake Asterisk log entries [epel-all]
by bugzilla＠redhat.com 11 Mar '25

11 Mar '25

https://bugzilla.redhat.com/show_bug.cgi?id=2255322 Bug ID: 2255322 Summary: asterisk: PJSIP logging allows attacker to inject fake Asterisk log entries [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: asterisk Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: epel-packagers-sig(a)lists.fedoraproject.org Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: bennie.joubert(a)jsdaav.com, epel-packagers-sig(a)lists.fedoraproject.org, jsmith.fedora(a)gmail.com, rbryant(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2255321 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are the assignee for the bug. You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2255322 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2271016] New: CVE-2024-28579 freeimage: buffer overflow in FreeImage_Unload() function when reading images in HDR format [epel-all]
by bugzilla＠redhat.com 11 Mar '25

11 Mar '25

https://bugzilla.redhat.com/show_bug.cgi?id=2271016 Bug ID: 2271016 Summary: CVE-2024-28579 freeimage: buffer overflow in FreeImage_Unload() function when reading images in HDR format [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: freeimage Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: hobbes1069(a)gmail.com Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: bruno(a)wolff.to, epel-packagers-sig(a)lists.fedoraproject.org, hobbes1069(a)gmail.com, i(a)cicku.me, manisandro(a)gmail.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2271014 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2271016 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2271034] New: CVE-2024-28583 freeimage: buffer overflow in readLine() function when reading images in XPM format [epel-all]
by bugzilla＠redhat.com 11 Mar '25

11 Mar '25

https://bugzilla.redhat.com/show_bug.cgi?id=2271034 Bug ID: 2271034 Summary: CVE-2024-28583 freeimage: buffer overflow in readLine() function when reading images in XPM format [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: freeimage Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: hobbes1069(a)gmail.com Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: bruno(a)wolff.to, epel-packagers-sig(a)lists.fedoraproject.org, hobbes1069(a)gmail.com, i(a)cicku.me, manisandro(a)gmail.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2271029 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2271034 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2270957] New: CVE-2024-28577 freeimage: Null Pointer Dereference in jpeg_read_exif_profile_raw() [epel-all]
by bugzilla＠redhat.com 11 Mar '25

11 Mar '25

https://bugzilla.redhat.com/show_bug.cgi?id=2270957 Bug ID: 2270957 Summary: CVE-2024-28577 freeimage: Null Pointer Dereference in jpeg_read_exif_profile_raw() [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: freeimage Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: hobbes1069(a)gmail.com Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: bruno(a)wolff.to, epel-packagers-sig(a)lists.fedoraproject.org, hobbes1069(a)gmail.com, i(a)cicku.me, manisandro(a)gmail.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2270956 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2270957 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2271040] New: CVE-2024-28562 freeimage: buffer overflow in Imf_2_2::copyIntoFrameBuffer() component when reading images in EXR format [epel-all]
by bugzilla＠redhat.com 11 Mar '25

11 Mar '25

https://bugzilla.redhat.com/show_bug.cgi?id=2271040 Bug ID: 2271040 Summary: CVE-2024-28562 freeimage: buffer overflow in Imf_2_2::copyIntoFrameBuffer() component when reading images in EXR format [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: freeimage Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: hobbes1069(a)gmail.com Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: bruno(a)wolff.to, epel-packagers-sig(a)lists.fedoraproject.org, hobbes1069(a)gmail.com, i(a)cicku.me, manisandro(a)gmail.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2271038 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2271040 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2093320] New: CVE-2022-30785 ntfs-3g: a file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations
by bugzilla＠redhat.com 11 Mar '25

11 Mar '25

https://bugzilla.redhat.com/show_bug.cgi?id=2093320 Bug ID: 2093320 Summary: CVE-2022-30785 ntfs-3g: a file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: ddepaula(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, jferlan(a)redhat.com, kparal(a)redhat.com, ngompa13(a)gmail.com, rjones(a)redhat.com, spotrh(a)gmail.com, virt-maint(a)redhat.com Target Milestone: --- Classification: Other A file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations in NTFS-3G through 2021.8.22 when using libfuse-lite. References: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-6mv4-4v73-xw58 https://github.com/tuxera/ntfs-3g/releases -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093320

1 13

[Bug 2093323] New: CVE-2022-30785 ntfs-3g-system-compression: ntfs-3g: a file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations [epel-all]
by bugzilla＠redhat.com 11 Mar '25

11 Mar '25

https://bugzilla.redhat.com/show_bug.cgi?id=2093323 Bug ID: 2093323 Summary: CVE-2022-30785 ntfs-3g-system-compression: ntfs-3g: a file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093323

1 4

[Bug 2270984] New: CVE-2024-28574 freeimage: buffer overflow in opj_j2k_copy_default_tcp_and_create_tcd() function when reading images in J2K format [epel-all]
by bugzilla＠redhat.com 11 Mar '25

11 Mar '25

https://bugzilla.redhat.com/show_bug.cgi?id=2270984 Bug ID: 2270984 Summary: CVE-2024-28574 freeimage: buffer overflow in opj_j2k_copy_default_tcp_and_create_tcd() function when reading images in J2K format [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: freeimage Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: hobbes1069(a)gmail.com Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: bruno(a)wolff.to, epel-packagers-sig(a)lists.fedoraproject.org, hobbes1069(a)gmail.com, i(a)cicku.me, manisandro(a)gmail.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2270969 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2270984 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2235357] New: CVE-2020-22524 freeimage: buffer overflow in FreeImage_Load() in Plugin.cpp [epel-all]
by bugzilla＠redhat.com 11 Mar '25

11 Mar '25

https://bugzilla.redhat.com/show_bug.cgi?id=2235357 Bug ID: 2235357 Summary: CVE-2020-22524 freeimage: buffer overflow in FreeImage_Load() in Plugin.cpp [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: freeimage Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: hobbes1069(a)gmail.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: bruno(a)wolff.to, epel-packagers-sig(a)lists.fedoraproject.org, hobbes1069(a)gmail.com, i(a)cicku.me, manisandro(a)gmail.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2235356 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2235357 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2270965] New: CVE-2024-28575 freeimage: buffer overflow in opj_j2k_read_mct() [epel-all]
by bugzilla＠redhat.com 11 Mar '25

11 Mar '25

https://bugzilla.redhat.com/show_bug.cgi?id=2270965 Bug ID: 2270965 Summary: CVE-2024-28575 freeimage: buffer overflow in opj_j2k_read_mct() [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: freeimage Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: hobbes1069(a)gmail.com Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: bruno(a)wolff.to, epel-packagers-sig(a)lists.fedoraproject.org, hobbes1069(a)gmail.com, i(a)cicku.me, manisandro(a)gmail.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2270964 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2270965 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

2025

2024

2023

2022

2021

Epel-packagers-sig April 2024