diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index 283da1e3066b..5055042c11c9 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,71 +1,112 @@ + + electron27 -- multiple vulnerabilities + + + electron27 + 27.2.1 + + + + +

Electron developers report:

+
+

This update fixes the following vulnerabilities:

+
    +
  • Security: backported fix for CVE-2023-6706.
    • +
  • Security: backported fix for CVE-2023-6705.
    • +
  • Security: backported fix for CVE-2023-6703.
    • +
  • Security: backported fix for CVE-2023-6702.
    • +
  • Security: backported fix for CVE-2023-6704.
    • +
+
+ + + + CVE-2023-6706 + https://github.com/advisories/GHSA-jqrg-rvpw-5fw5 + CVE-2023-6705 + https://github.com/advisories/GHSA-h27f-fw5q-c2gh + CVE-2023-6703 + https://github.com/advisories/GHSA-9v72-359m-2vx4 + CVE-2023-6702 + https://github.com/advisories/GHSA-7hjc-c62g-4w73 + CVE-2023-6704 + https://github.com/advisories/GHSA-587x-fmc5-99p9 + + + 2024-01-04 + 2024-01-04 + + + electron26 -- multiple vulnerabilities electron26 26.6.4

Electron developers report:

This update fixes the following vulnerabilities:

  • Security: backported fix for CVE-2023-6704.
  • Security: backported fix for CVE-2023-6705.
  • Security: backported fix for CVE-2023-6703.
  • Security: backported fix for CVE-2023-6702.
 CVE-2023-6704 https://github.com/advisories/GHSA-587x-fmc5-99p9 CVE-2023-6705 https://github.com/advisories/GHSA-h27f-fw5q-c2gh CVE-2023-6703 https://github.com/advisories/GHSA-9v72-359m-2vx4 CVE-2023-6702 https://github.com/advisories/GHSA-7hjc-c62g-4w73 2024-01-04 2024-01-04 FreeBSD -- Prefix Truncation Attack in the SSH protocol FreeBSD 14.014.0_4 13.213.2_9

Problem Description:

The SSH protocol executes an initial handshake between the server and the client. This protocol handshake includes the possibility of several extensions allowing different options to be selected. Validation of the packets in the handshake is done through sequence numbers.

Impact:

A man in the middle attacker can silently manipulate handshake messages to truncate extension negotiation messages potentially leading to less secure client authentication algorithms or deactivating keystroke timing attack countermeasures.

 CVE-2023-48795 SA-23:19.openssh 2023-12-19 2024-01-02