Publish Advisories

GHSA-2x7c-w8p7-47f7
GHSA-5rq4-c346-f9jq
GHSA-8xp8-gmmj-xc8w
GHSA-h732-87v7-7449

advisories/unreviewed/2024/12/GHSA-2x7c-w8p7-47f7/GHSA-2x7c-w8p7-47f7.json

@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2x7c-w8p7-47f7",
+  "modified": "2024-12-25T18:30:45Z",
+  "published": "2024-12-25T18:30:45Z",
+  "aliases": [
+    "CVE-2024-56430"
+  ],
+  "details": "OpenFHE through 1.2.3 has a NULL pointer dereference in BinFHEContext::EvalFloor in lib/binfhe-base-scheme.cpp.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56430"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/UnionTech-Software/openfhe-PoC"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/openfheorg/openfhe-development/blob/7b8346f4eac27121543e36c17237b919e03ec058/src/binfhe/lib/binfhe-base-scheme.cpp#L307-L308"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/openfheorg/openfhe-development/releases/tag/v1.2.3"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-476"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-12-25T18:15:22Z"
+  }
+}

advisories/unreviewed/2024/12/GHSA-5rq4-c346-f9jq/GHSA-5rq4-c346-f9jq.json

@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5rq4-c346-f9jq",
+  "modified": "2024-12-25T18:30:45Z",
+  "published": "2024-12-25T18:30:45Z",
+  "aliases": [
+    "CVE-2024-52534"
+  ],
+  "details": "Dell ECS, version(s) prior to ECS 3.8.1.3, contain(s) an Authentication Bypass by Capture-replay vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Session theft.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52534"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.dell.com/support/kbdoc/en-us/000256642/dsa-2024-483-security-update-for-dell-ecs-multiple-vulnerabilities"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-294"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-12-25T16:15:21Z"
+  }
+}

advisories/unreviewed/2024/12/GHSA-8xp8-gmmj-xc8w/GHSA-8xp8-gmmj-xc8w.json

@@ -0,0 +1,37 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8xp8-gmmj-xc8w",
+  "modified": "2024-12-25T18:30:45Z",
+  "published": "2024-12-25T18:30:45Z",
+  "aliases": [
+    "CVE-2024-56431"
+  ],
+  "details": "oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56431"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/xiph/theora/issues/17#issuecomment-2480630603"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/UnionTech-Software/libtheora-CVE-2024-56431-PoC"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/xiph/theora/blob/7180717276af1ebc7da15c83162d6c5d6203aabf/lib/huffdec.c#L193"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-12-25T17:15:05Z"
+  }
+}

advisories/unreviewed/2024/12/GHSA-h732-87v7-7449/GHSA-h732-87v7-7449.json

@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-h732-87v7-7449",
+  "modified": "2024-12-25T18:30:45Z",
+  "published": "2024-12-25T18:30:45Z",
+  "aliases": [
+    "CVE-2024-52543"
+  ],
+  "details": "Dell NativeEdge, version(s) 2.1.0.0, contain(s) a Creation of Temporary File With Insecure Permissions vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52543"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.dell.com/support/kbdoc/en-us/000258904/dsa-2024-488-security-update-for-dell-nativeedge-multiple-vulnerabilities"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-378"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-12-25T16:15:22Z"
+  }
+}