[Build 20210728] qgis failed to build VUL-0: CVE-2022-3725: wireshark: integer overflow in the OPUS dissector leads to stack buffer overflow VUL-0: CVE-2023-28101: flatpak: Metadata with ANSI control codes can cause misleading terminal output VUL-0: CVE-2023-28100: flatpak: TIOCLINUX can send commands outside sandbox if running on a virtual console IceWM gnome-terminal delayed startup when xdg-portal-desktop-gnome and xdg-portal-desktop-gtk are installed patch shebang line match the python version required in the package VUL-0: CVE-2023-50980: libcryptopp: DoS via malformed DER public key file VUL-0: CVE-2023-50981: libcryptopp: issue on ModularSquareRoot function leads to potential DoS VUL-0: CVE-2024-24476: wireshark: Buffer Overflow via pan/addr_resolv.c and ws_manuf_lookup_str() results in Denial of Service [SELinux] flatpak: "Warning: Failed to get revokefs-fuse socket from system-helper" with selinux in enforcing during install/update VUL-0: flatpak: Flathub repository is enabled by default GCC 14: ghostscript package fails VUL-0: CVE-2024-2955: wireshark: T.38 dissector crash in Wireshark 4.2.0 to 4.0.3 and 4.0.0 to 4.0.13 allows denial of service via packet injection or crafted capture file VUL-0: CVE-2024-32462: flatpak,xdg-desktop-portal: sandbox escape via RequestBackground portal VUL-0: CVE-2023-52722: ghostscript: eexec seeds other than the Type 1 standard are allowed while using SAFER mode VUL-0: CVE-2024-4853: wireshark: memory handling issue in editcap could cause denial of service via crafted capture file VUL-0: CVE-2024-4854: wireshark: MONGO and ZigBee TLV dissector infinite loops via packet injection or crafted capture file VUL-0: CVE-2024-4855: wireshark: use-after-free issue in editcap could cause denial of service via crafted capture file VUL-0: CVE-2024-33871: ghostscript,ghostscript-library: ghostscript: OPVP device arbitrary code execution via custom Driver library VUL-0: CVE-2024-5171: libaom: heap buffer overflow in img_alloc_helper() caused by integer overflow VUL-0: CVE-2024-6239: poppler,poppler-qt: crash when using pdfinfo with -dests parameter on malformed input files VUL-0: CVE-2024-33870: ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths VUL-0: CVE-2024-29510: ghostscript,ghostscript-library: format string injection leads to shell command execution (SAFER bypass) VUL-0: CVE-2024-33869: ghostscript: path traversal and command execution due to path reduction VUL-0: CVE-2024-42472: flatpak: access to files outside sandbox for apps using persistent= (--persist) VUL-0: CVE-2024-8250: wireshark: NTLMSSP dissector crash pgajdos critical security

Security update for ghostscript, bubblewrap, libaom, poppler, libcryptopp, xdg-desktop-portal, wireshark, flatpak

This update for ghostscript, bubblewrap, libaom, poppler, libcryptopp, xdg-desktop-portal, wireshark, flatpak fixes the following issues: bubblewrap: - Update to version v0.10.0: flatpak: - Update to version 1.15.10: ghostscript: - Version upgrade to 10.03.1: libaom: fix CVE-2024-5171 [bsc#1226020], heap buffer overflow in img_alloc_helper() caused by integer overflow libcryptopp: fix CVE-2023-50980 [bsc#1218219], DoS via malformed DER public key file fix CVE-2023-50981 [bsc#1218222], issue on ModularSquareRoot function leads to potential DoS poppler: fix CVE-2024-6239 [bsc#1226916], crash when using pdfinfo with -dests parameter on malformed input files wireshark: - Wireshark 4.2.7: xdg-desktop-portal: - update to 1.18.4: bubblewrap flatpak ghostscript libaom libaom:doc libcryptopp poppler poppler:qt5 poppler:qt6 wireshark xdg-desktop-portal