Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -2 articles for you...
100
security advisorydenial of serviceSuSESUSE Linux 15 SP7 Security Advisories for mozjs60 Denial of Service
An update that solves three vulnerabilities can now be installed.. # Security update for mozjs60 Announcement ID: SUSE-SU-2026:1817-1 Release Date: 2026-05-12T07:58:34Z Rating: important References: * bsc#1259713 * bsc#1259728 * bsc#1259731 Cross-References: * CVE-2026-32776 * CVE-2026-32777 * CVE-2026-32778 CVSS scores: * CVE-2026-32776 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-32776 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-32776 ( NVD ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-32776 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2026-32777 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-32777 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-32777 ( NVD ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-32777 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2026-32778 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-32778 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-32778 ( NVD ): 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-32778 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: * Basesystem Module 15-SP7 * Desktop Applications Module 15-SP7 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher5.4 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 An update that solves three vulnerabilities can now be installed. ## Description: This update for mozjs60 fixes the following issues * CVE-2026-32776: libexpat: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259728). * CVE-2026-32777: libexpat: denial of service due to infinite loop in DTD content parsing (bsc#1259713). * CVE-2026-32778: libexpat: NULL pointer dereference in `setContext` on retry after an out-of-memory condition (bsc#1259731). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 15 SP4 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1817=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1817=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2026-1817=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2026-1817=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2026-1817=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2026-1817=1 * Basesystem Module 15-SP7 zypper in -t patchSUSE-SLE-Module-Basesystem-15-SP7-2026-1817=1 * Desktop Applications Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP7-2026-1817=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1817=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1817=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1817=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1817=1 * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1817=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1817=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-1817=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1817=1 ## Package List: * SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64) * mozjs60-devel-60.9.0-150200.6.11.1 * libmozjs-60-60.9.0-150200.6.11.1 * libmozjs-60-debuginfo-60.9.0-150200.6.11.1 * mozjs60-debugsource-60.9.0-150200.6.11.1 * mozjs60-debuginfo-60.9.0-150200.6.11.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64) * mozjs60-devel-60.9.0-150200.6.11.1 * libmozjs-60-60.9.0-150200.6.11.1 * libmozjs-60-debuginfo-60.9.0-150200.6.11.1 * mozjs60-debugsource-60.9.0-150200.6.11.1 * mozjs60-debuginfo-60.9.0-150200.6.11.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * mozjs60-debuginfo-60.9.0-150200.6.11.1 * mozjs60-debugsource-60.9.0-150200.6.11.1 * libmozjs-60-60.9.0-150200.6.11.1 * libmozjs-60-debuginfo-60.9.0-150200.6.11.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * mozjs60-debuginfo-60.9.0-150200.6.11.1 * mozjs60-debugsource-60.9.0-150200.6.11.1 * libmozjs-60-60.9.0-150200.6.11.1 * libmozjs-60-debuginfo-60.9.0-150200.6.11.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * mozjs60-debuginfo-60.9.0-150200.6.11.1 * mozjs60-debugsource-60.9.0-150200.6.11.1 * libmozjs-60-60.9.0-150200.6.11.1 * libmozjs-60-debuginfo-60.9.0-150200.6.11.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * mozjs60-debuginfo-60.9.0-150200.6.11.1 * mozjs60-debugsource-60.9.0-150200.6.11.1 * libmozjs-60-60.9.0-150200.6.11.1 * libmozjs-60-debuginfo-60.9.0-150200.6.11.1 * Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64) * mozjs60-debuginfo-60.9.0-150200.6.11.1 * mozjs60-debugsource-60.9.0-150200.6.11.1 * libmozjs-60-60.9.0-150200.6.11.1 * libmozjs-60-debuginfo-60.9.0-150200.6.11.1 * Desktop Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64) * mozjs60-devel-60.9.0-150200.6.11.1 * mozjs60-debuginfo-60.9.0-150200.6.11.1 * mozjs60-debugsource-60.9.0-150200.6.11.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * mozjs60-devel-60.9.0-150200.6.11.1 * libmozjs-60-60.9.0-150200.6.11.1 * libmozjs-60-debuginfo-60.9.0-150200.6.11.1 * mozjs60-debugsource-60.9.0-150200.6.11.1 * mozjs60-debuginfo-60.9.0-150200.6.11.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * mozjs60-devel-60.9.0-150200.6.11.1 * libmozjs-60-60.9.0-150200.6.11.1 * libmozjs-60-debuginfo-60.9.0-150200.6.11.1 * mozjs60-debugsource-60.9.0-150200.6.11.1 * mozjs60-debuginfo-60.9.0-150200.6.11.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64 x86_64) * mozjs60-devel-60.9.0-150200.6.11.1 * libmozjs-60-60.9.0-150200.6.11.1 *libmozjs-60-debuginfo-60.9.0-150200.6.11.1 * mozjs60-debugsource-60.9.0-150200.6.11.1 * mozjs60-debuginfo-60.9.0-150200.6.11.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64 x86_64) * mozjs60-devel-60.9.0-150200.6.11.1 * libmozjs-60-60.9.0-150200.6.11.1 * libmozjs-60-debuginfo-60.9.0-150200.6.11.1 * mozjs60-debugsource-60.9.0-150200.6.11.1 * mozjs60-debuginfo-60.9.0-150200.6.11.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64) * mozjs60-devel-60.9.0-150200.6.11.1 * libmozjs-60-60.9.0-150200.6.11.1 * libmozjs-60-debuginfo-60.9.0-150200.6.11.1 * mozjs60-debugsource-60.9.0-150200.6.11.1 * mozjs60-debuginfo-60.9.0-150200.6.11.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * mozjs60-devel-60.9.0-150200.6.11.1 * libmozjs-60-60.9.0-150200.6.11.1 * libmozjs-60-debuginfo-60.9.0-150200.6.11.1 * mozjs60-debugsource-60.9.0-150200.6.11.1 * mozjs60-debuginfo-60.9.0-150200.6.11.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64) * mozjs60-devel-60.9.0-150200.6.11.1 * libmozjs-60-60.9.0-150200.6.11.1 * libmozjs-60-debuginfo-60.9.0-150200.6.11.1 * mozjs60-debugsource-60.9.0-150200.6.11.1 * mozjs60-debuginfo-60.9.0-150200.6.11.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64) * mozjs60-devel-60.9.0-150200.6.11.1 * libmozjs-60-60.9.0-150200.6.11.1 * libmozjs-60-debuginfo-60.9.0-150200.6.11.1 * mozjs60-debugsource-60.9.0-150200.6.11.1 * mozjs60-debuginfo-60.9.0-150200.6.11.1 ## References: * https://www.suse.com/security/cve/CVE-2026-32776.html * https://www.suse.com/security/cve/CVE-2026-32777.html * https://www.suse.com/security/cve/CVE-2026-32778.html * https://bugzilla.suse.com/show_bug.cgi?id=1259713 * https://bugzilla.suse.com/show_bug.cgi?id=1259728 * https://bugzilla.suse.com/show_bug.cgi?id=1259731 . Important update for SUSE mozjs60 fixes threesecurity issues including denial of service and null pointer dereference.. SUSE Security, mozjs60 Update, Linux Vulnerability Fix. . Severity: Important. LinuxSecurity.com Team
May 13, 2026
•Important
SuSE
100
security advisorymoderateSuSESUSE: mozjs60 Important Security Update Addressing Embedded Expat Issues
An update that solves four vulnerabilities can now be installed.. # Security update for mozjs60 Announcement ID: SUSE-SU-2026:0044-1 Release Date: 2026-01-06T16:10:26Z Rating: moderate References: * bsc#1230036 * bsc#1230037 * bsc#1230038 * bsc#1232602 Cross-References: * CVE-2024-45490 * CVE-2024-45491 * CVE-2024-45492 * CVE-2024-50602 CVSS scores: * CVE-2024-45490 ( SUSE ): 6.9 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2024-45490 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-45490 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-45490 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-45491 ( SUSE ): 6.9 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2024-45491 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-45491 ( NVD ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-45491 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-45492 ( SUSE ): 6.9 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2024-45492 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-45492 ( NVD ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-45492 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-50602 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2024-50602 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-50602 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * Basesystem Module 15-SP7 * Desktop Applications Module 15-SP7 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.2 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux EnterpriseMicro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 An update that solves four vulnerabilities can now be installed. ## Description: This update for mozjs60 fixes the following issues: * CVE-2024-50602: embedded expat: make XML_StopParser refuse to stop/suspend an unstarted parser and be explicit about XML_PARSING in XML_StopParser (bsc#1232602) * CVE-2024-45492: embedded expat: detect integer overflow in function nextScaffoldPart (bsc#1230038) * CVE-2024-45491: embedded expat: detect integer overflow in dtdCopy (bsc#1230037) * CVE-2024-45490: embedded expat: reject negative len for XML_ParseBuffer (bsc#1230036) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2026-44=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2026-44=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2026-44=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2026-44=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2026-44=1 * Basesystem Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-44=1 * Desktop Applications Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP7-2026-44=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2026-44=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2026-44=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * libmozjs-60-debuginfo-60.9.0-150200.6.8.1 * mozjs60-devel-60.9.0-150200.6.8.1 *mozjs60-debuginfo-60.9.0-150200.6.8.1 * mozjs60-60.9.0-150200.6.8.1 * libmozjs-60-60.9.0-150200.6.8.1 * mozjs60-debugsource-60.9.0-150200.6.8.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * mozjs60-debugsource-60.9.0-150200.6.8.1 * libmozjs-60-debuginfo-60.9.0-150200.6.8.1 * libmozjs-60-60.9.0-150200.6.8.1 * mozjs60-debuginfo-60.9.0-150200.6.8.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * mozjs60-debugsource-60.9.0-150200.6.8.1 * libmozjs-60-debuginfo-60.9.0-150200.6.8.1 * libmozjs-60-60.9.0-150200.6.8.1 * mozjs60-debuginfo-60.9.0-150200.6.8.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * mozjs60-debugsource-60.9.0-150200.6.8.1 * libmozjs-60-debuginfo-60.9.0-150200.6.8.1 * libmozjs-60-60.9.0-150200.6.8.1 * mozjs60-debuginfo-60.9.0-150200.6.8.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * mozjs60-debugsource-60.9.0-150200.6.8.1 * libmozjs-60-debuginfo-60.9.0-150200.6.8.1 * libmozjs-60-60.9.0-150200.6.8.1 * mozjs60-debuginfo-60.9.0-150200.6.8.1 * Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64) * mozjs60-debugsource-60.9.0-150200.6.8.1 * libmozjs-60-debuginfo-60.9.0-150200.6.8.1 * libmozjs-60-60.9.0-150200.6.8.1 * mozjs60-debuginfo-60.9.0-150200.6.8.1 * Desktop Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64) * mozjs60-debugsource-60.9.0-150200.6.8.1 * mozjs60-devel-60.9.0-150200.6.8.1 * mozjs60-debuginfo-60.9.0-150200.6.8.1 * SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64) * mozjs60-debugsource-60.9.0-150200.6.8.1 * libmozjs-60-debuginfo-60.9.0-150200.6.8.1 * libmozjs-60-60.9.0-150200.6.8.1 * mozjs60-debuginfo-60.9.0-150200.6.8.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (aarch64 s390x x86_64) * mozjs60-debugsource-60.9.0-150200.6.8.1 * libmozjs-60-debuginfo-60.9.0-150200.6.8.1 * libmozjs-60-60.9.0-150200.6.8.1 * mozjs60-debuginfo-60.9.0-150200.6.8.1 ##References: * https://www.suse.com/security/cve/CVE-2024-45490.html * https://www.suse.com/security/cve/CVE-2024-45491.html * https://www.suse.com/security/cve/CVE-2024-45492.html * https://www.suse.com/security/cve/CVE-2024-50602.html * https://bugzilla.suse.com/show_bug.cgi?id=1230036 * https://bugzilla.suse.com/show_bug.cgi?id=1230037 * https://bugzilla.suse.com/show_bug.cgi?id=1230038 * https://bugzilla.suse.com/show_bug.cgi?id=1232602 . Update fixes four issues in mozjs60, addressing multiple vulnerabilities with moderate severity. Installation advised.. mozjs60 update,suse linux security,patch installation,moderate severity. . LinuxSecurity.com Team
Jan 07, 2026
SuSE
202
security advisorymoderatethreatopenSUSE: mozjs60 Moderate Security Fix CVE-2024-45490 2026:0044-1
An update that solves four vulnerabilities can now be installed.. # Security update for mozjs60 Announcement ID: SUSE-SU-2026:0044-1 Release Date: 2026-01-06T16:10:26Z Rating: moderate References: * bsc#1230036 * bsc#1230037 * bsc#1230038 * bsc#1232602 Cross-References: * CVE-2024-45490 * CVE-2024-45491 * CVE-2024-45492 * CVE-2024-50602 CVSS scores: * CVE-2024-45490 ( SUSE ): 6.9 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2024-45490 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-45490 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-45490 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-45491 ( SUSE ): 6.9 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2024-45491 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-45491 ( NVD ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-45491 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-45492 ( SUSE ): 6.9 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2024-45492 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-45492 ( NVD ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-45492 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-50602 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2024-50602 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-50602 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * Basesystem Module 15-SP7 * Desktop Applications Module 15-SP7 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.2 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux EnterpriseMicro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 An update that solves four vulnerabilities can now be installed. ## Description: This update for mozjs60 fixes the following issues: * CVE-2024-50602: embedded expat: make XML_StopParser refuse to stop/suspend an unstarted parser and be explicit about XML_PARSING in XML_StopParser (bsc#1232602) * CVE-2024-45492: embedded expat: detect integer overflow in function nextScaffoldPart (bsc#1230038) * CVE-2024-45491: embedded expat: detect integer overflow in dtdCopy (bsc#1230037) * CVE-2024-45490: embedded expat: reject negative len for XML_ParseBuffer (bsc#1230036) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2026-44=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2026-44=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2026-44=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2026-44=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2026-44=1 * Basesystem Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-44=1 * Desktop Applications Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP7-2026-44=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2026-44=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2026-44=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * libmozjs-60-debuginfo-60.9.0-150200.6.8.1 * mozjs60-devel-60.9.0-150200.6.8.1 *mozjs60-debuginfo-60.9.0-150200.6.8.1 * mozjs60-60.9.0-150200.6.8.1 * libmozjs-60-60.9.0-150200.6.8.1 * mozjs60-debugsource-60.9.0-150200.6.8.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * mozjs60-debugsource-60.9.0-150200.6.8.1 * libmozjs-60-debuginfo-60.9.0-150200.6.8.1 * libmozjs-60-60.9.0-150200.6.8.1 * mozjs60-debuginfo-60.9.0-150200.6.8.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * mozjs60-debugsource-60.9.0-150200.6.8.1 * libmozjs-60-debuginfo-60.9.0-150200.6.8.1 * libmozjs-60-60.9.0-150200.6.8.1 * mozjs60-debuginfo-60.9.0-150200.6.8.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * mozjs60-debugsource-60.9.0-150200.6.8.1 * libmozjs-60-debuginfo-60.9.0-150200.6.8.1 * libmozjs-60-60.9.0-150200.6.8.1 * mozjs60-debuginfo-60.9.0-150200.6.8.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * mozjs60-debugsource-60.9.0-150200.6.8.1 * libmozjs-60-debuginfo-60.9.0-150200.6.8.1 * libmozjs-60-60.9.0-150200.6.8.1 * mozjs60-debuginfo-60.9.0-150200.6.8.1 * Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64) * mozjs60-debugsource-60.9.0-150200.6.8.1 * libmozjs-60-debuginfo-60.9.0-150200.6.8.1 * libmozjs-60-60.9.0-150200.6.8.1 * mozjs60-debuginfo-60.9.0-150200.6.8.1 * Desktop Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64) * mozjs60-debugsource-60.9.0-150200.6.8.1 * mozjs60-devel-60.9.0-150200.6.8.1 * mozjs60-debuginfo-60.9.0-150200.6.8.1 * SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64) * mozjs60-debugsource-60.9.0-150200.6.8.1 * libmozjs-60-debuginfo-60.9.0-150200.6.8.1 * libmozjs-60-60.9.0-150200.6.8.1 * mozjs60-debuginfo-60.9.0-150200.6.8.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (aarch64 s390x x86_64) * mozjs60-debugsource-60.9.0-150200.6.8.1 * libmozjs-60-debuginfo-60.9.0-150200.6.8.1 * libmozjs-60-60.9.0-150200.6.8.1 * mozjs60-debuginfo-60.9.0-150200.6.8.1 ##References: * https://www.suse.com/security/cve/CVE-2024-45490.html * https://www.suse.com/security/cve/CVE-2024-45491.html * https://www.suse.com/security/cve/CVE-2024-45492.html * https://www.suse.com/security/cve/CVE-2024-50602.html * https://bugzilla.suse.com/show_bug.cgi?id=1230036 * https://bugzilla.suse.com/show_bug.cgi?id=1230037 * https://bugzilla.suse.com/show_bug.cgi?id=1230038 * https://bugzilla.suse.com/show_bug.cgi?id=1232602 . Four vulnerabilities resolved for mozjs60 on openSUSE through this important update, improving overall security.. mozjs60 security update, openSUSE vulnerability fix, moderate risk advisories. . LinuxSecurity.com Team
Jan 07, 2026
OpenSUSE
202
security advisoryupdatepatchopenSUSE 15.6: 2025:1365-1 moderate: mozjs60 risk adjustment
An update that solves one vulnerability can now be installed.. # Security update for mozjs60 Announcement ID: SUSE-SU-2025:1365-1 Release Date: 2025-04-24T12:07:43Z Rating: moderate References: * bsc#1234837 Cross-References: * CVE-2024-56431 CVSS scores: * CVE-2024-56431 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2024-56431 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-56431 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP6 * Desktop Applications Module 15-SP6 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.2 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves one vulnerability can now be installed. ## Description: This update for mozjs60 fixes the following issues: * CVE-2024-56431: Fixed a negative shift in huffdec.c (bsc#1234837). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2025-1365=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2025-1365=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2025-1365=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2025-1365=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2025-1365=1 * Basesystem Module15-SP6 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2025-1365=1 * Desktop Applications Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP6-2025-1365=1 * SUSE Linux Enterprise Micro 5.1 zypper in -t patch SUSE-SUSE-MicroOS-5.1-2025-1365=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2025-1365=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2025-1365=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * libmozjs-60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-60.9.0-150200.6.3.1 * mozjs60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-devel-60.9.0-150200.6.3.1 * libmozjs-60-60.9.0-150200.6.3.1 * mozjs60-debugsource-60.9.0-150200.6.3.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * libmozjs-60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debugsource-60.9.0-150200.6.3.1 * libmozjs-60-60.9.0-150200.6.3.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * libmozjs-60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debugsource-60.9.0-150200.6.3.1 * libmozjs-60-60.9.0-150200.6.3.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * libmozjs-60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debugsource-60.9.0-150200.6.3.1 * libmozjs-60-60.9.0-150200.6.3.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * libmozjs-60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debugsource-60.9.0-150200.6.3.1 * libmozjs-60-60.9.0-150200.6.3.1 * Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64) * libmozjs-60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debugsource-60.9.0-150200.6.3.1 * libmozjs-60-60.9.0-150200.6.3.1 * Desktop ApplicationsModule 15-SP6 (aarch64 ppc64le s390x x86_64) * mozjs60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-devel-60.9.0-150200.6.3.1 * mozjs60-debugsource-60.9.0-150200.6.3.1 * SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64) * libmozjs-60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debugsource-60.9.0-150200.6.3.1 * libmozjs-60-60.9.0-150200.6.3.1 * SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64) * libmozjs-60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debugsource-60.9.0-150200.6.3.1 * libmozjs-60-60.9.0-150200.6.3.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (aarch64 s390x x86_64) * libmozjs-60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debugsource-60.9.0-150200.6.3.1 * libmozjs-60-60.9.0-150200.6.3.1 ## References: * https://www.suse.com/security/cve/CVE-2024-56431.html * https://bugzilla.suse.com/show_bug.cgi?id=1234837 . Moderate security update for openSUSE affecting mozjs60, addressing critical issues and improving system integrity.. SUSE Security, mozjs60 Update, Linux Patch Management, OpenSUSE Advisory. . LinuxSecurity.com Team
Apr 24, 2025
OpenSUSE
100
security advisorymoderatepatchSUSE: 2025:1365-1 moderate: Fixed negative shift in mozjs60
* bsc#1234837 Cross-References: * CVE-2024-56431 . # Security update for mozjs60 Announcement ID: SUSE-SU-2025:1365-1 Release Date: 2025-04-24T12:07:43Z Rating: moderate References: * bsc#1234837 Cross-References: * CVE-2024-56431 CVSS scores: * CVE-2024-56431 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2024-56431 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-56431 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP6 * Desktop Applications Module 15-SP6 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.2 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves one vulnerability can now be installed. ## Description: This update for mozjs60 fixes the following issues: * CVE-2024-56431: Fixed a negative shift in huffdec.c (bsc#1234837). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2025-1365=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2025-1365=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2025-1365=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2025-1365=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2025-1365=1 * Basesystem Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2025-1365=1 * Desktop Applications Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP6-2025-1365=1 * SUSE Linux Enterprise Micro 5.1 zypper in -t patch SUSE-SUSE-MicroOS-5.1-2025-1365=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2025-1365=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2025-1365=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * libmozjs-60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-60.9.0-150200.6.3.1 * mozjs60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-devel-60.9.0-150200.6.3.1 * libmozjs-60-60.9.0-150200.6.3.1 * mozjs60-debugsource-60.9.0-150200.6.3.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * libmozjs-60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debugsource-60.9.0-150200.6.3.1 * libmozjs-60-60.9.0-150200.6.3.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * libmozjs-60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debugsource-60.9.0-150200.6.3.1 * libmozjs-60-60.9.0-150200.6.3.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * libmozjs-60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debugsource-60.9.0-150200.6.3.1 * libmozjs-60-60.9.0-150200.6.3.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * libmozjs-60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debugsource-60.9.0-150200.6.3.1 * libmozjs-60-60.9.0-150200.6.3.1 * Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64) * libmozjs-60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debugsource-60.9.0-150200.6.3.1 * libmozjs-60-60.9.0-150200.6.3.1 * Desktop Applications Module 15-SP6(aarch64 ppc64le s390x x86_64) * mozjs60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-devel-60.9.0-150200.6.3.1 * mozjs60-debugsource-60.9.0-150200.6.3.1 * SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64) * libmozjs-60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debugsource-60.9.0-150200.6.3.1 * libmozjs-60-60.9.0-150200.6.3.1 * SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64) * libmozjs-60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debugsource-60.9.0-150200.6.3.1 * libmozjs-60-60.9.0-150200.6.3.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (aarch64 s390x x86_64) * libmozjs-60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debuginfo-60.9.0-150200.6.3.1 * mozjs60-debugsource-60.9.0-150200.6.3.1 * libmozjs-60-60.9.0-150200.6.3.1 ## References: * https://www.suse.com/security/cve/CVE-2024-56431.html * https://bugzilla.suse.com/show_bug.cgi?id=1234837 . SUSE has released a patch for CVE-2024-56432 in mozjs70, rated with moderate risk, improving system protection.. SUSE Security Update, mozjs60 Patch, Linux Vulnerability, SUSE Linux Update. . LinuxSecurity.com Team
Apr 24, 2025
SuSE
203
security advisorysecurity issuejavascriptMageia 7 MGASA-2020-0009 Moderate: mozjs60 Type Confusion Security Flaw
The updated packages fix security vulnerabilities: A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. . MGASA-2020-0009 - Updated mozjs60 packages fix security vulnerability Publication date: 05 Jan 2020 URL: https://advisories.mageia.org/MGASA-2020-0009.html Type: security Affected Mageia releases: 7 CVE: CVE-2019-11707, CVE-2019-11708 The updated packages fix security vulnerabilities: A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2. (CVE-2019-11707) Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2. (CVE-2019-11708) The mozjs60 package has been updated to version 60.9.0, fixing these issues and other bugs. The gjs package has been rebuilt against the updated mozjs60. References: - https://bugs.mageia.org/show_bug.cgi?id=25910 - https://lists.fedoraproject.org/archives/list/
Jan 05, 2020
Mageia
89
security advisoryFedoraCVE fixFedora 30: FEDORA-2019-c2ff49ef73 Critical: mozjs60 Security Flaws
Fix CVE-2019-11707 Fix CVE-2019-11708. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-c2ff49ef73 2019-06-24 00:56:26.731963 --------------------------------------------------------------------------------Name : mozjs60 Product : Fedora 30 Version : 60.7.2 Release : 1.fc30 URL : Summary : SpiderMonkey JavaScript library Description : SpiderMonkey is the code-name for Mozilla Firefox's C++ implementation of JavaScript. It is intended to be embedded in other applications that provide host environments for JavaScript. --------------------------------------------------------------------------------Update Information: Fix CVE-2019-11707 Fix CVE-2019-11708 --------------------------------------------------------------------------------ChangeLog: * Sat Jun 22 2019 Frantisek Zatloukal - 60.7.2-1 - Update to 60.7.2 * Wed Jun 19 2019 Frantisek Zatloukal - 60.7.1-1 - Update to 60.7.1 * Tue May 21 2019 Kalev Lember - 60.7.0-1 - Update to 60.7.0 * Mon Apr 15 2019 Frantisek Zatloukal - 60.6.1-2 - Backport two Firefox 61 patches and allow compiler optimizations on aarch64 * Sun Apr 14 2019 Frantisek Zatloukal - 60.6.1-1 - Update to 60.6.1 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-c2ff49ef73' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jun 23, 2019
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!