ALT Vulnerability

oval/c10f1/ALT-PU-2021-1460/definitions.json

@@ -827,7 +827,7 @@
               "ID": "CVE-2021-21166",
               "CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
               "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
-              "CWE": "NVD-CWE-Other",
+              "CWE": "CWE-362",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-21166",
               "Impact": "High",
               "Public": "20210309"

oval/c10f1/ALT-PU-2021-1668/definitions.json

@@ -997,7 +997,7 @@
               "ID": "CVE-2021-21166",
               "CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
               "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
-              "CWE": "NVD-CWE-Other",
+              "CWE": "CWE-362",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-21166",
               "Impact": "High",
               "Public": "20210309"

oval/c10f1/ALT-PU-2024-6898/definitions.json

@@ -58,7 +58,7 @@
         "Description": "This update upgrades freerdp to version 2.11.6-alt1. \nSecurity Fix(es):\n\n * CVE-2024-32039: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with `/bpp:32` or `/rfx` as it is on by default).\n\n * CVE-2024-32040: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).\n\n * CVE-2024-32041: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.\n\n * CVE-2024-32458: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).\n\n * CVE-2024-32459: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. No known workarounds are available.\n\n * CVE-2024-32460: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths (e.g. `/rfx` or `/gfx` options). The workaround requires server side support.",
         "Advisory": {
           "From": "errata.altlinux.org",
-          "Severity": "Low",
+          "Severity": "Critical",
           "Rights": "Copyright 2024 BaseALT Ltd.",
           "Issued": {
             "Date": "2024-04-21"
@@ -70,38 +70,50 @@
           "CVEs": [
             {
               "ID": "CVE-2024-32039",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-787",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32039",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32040",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-191",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32040",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32041",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-125",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32041",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32458",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-125",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32458",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32459",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-125",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32459",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32460",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-125",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32460",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             }
           ],

oval/c9f2/ALT-PU-2021-2141/definitions.json

@@ -2619,7 +2619,7 @@
               "ID": "CVE-2021-21166",
               "CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
               "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
-              "CWE": "NVD-CWE-Other",
+              "CWE": "CWE-362",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-21166",
               "Impact": "High",
               "Public": "20210309"

oval/c9f2/ALT-PU-2024-6847/definitions.json

@@ -58,7 +58,7 @@
         "Description": "This update upgrades freerdp to version 2.11.6-alt1. \nSecurity Fix(es):\n\n * CVE-2024-32039: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with `/bpp:32` or `/rfx` as it is on by default).\n\n * CVE-2024-32040: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).\n\n * CVE-2024-32041: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.\n\n * CVE-2024-32458: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).\n\n * CVE-2024-32459: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. No known workarounds are available.\n\n * CVE-2024-32460: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths (e.g. `/rfx` or `/gfx` options). The workaround requires server side support.",
         "Advisory": {
           "From": "errata.altlinux.org",
-          "Severity": "Low",
+          "Severity": "Critical",
           "Rights": "Copyright 2024 BaseALT Ltd.",
           "Issued": {
             "Date": "2024-04-19"
@@ -70,38 +70,50 @@
           "CVEs": [
             {
               "ID": "CVE-2024-32039",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-787",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32039",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32040",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-191",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32040",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32041",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-125",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32041",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32458",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-125",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32458",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32459",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-125",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32459",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32460",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-125",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32460",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             }
           ],

oval/p10/ALT-PU-2021-1460/definitions.json

@@ -833,7 +833,7 @@
               "ID": "CVE-2021-21166",
               "CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
               "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
-              "CWE": "NVD-CWE-Other",
+              "CWE": "CWE-362",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-21166",
               "Impact": "High",
               "Public": "20210309"

oval/p10/ALT-PU-2021-1668/definitions.json

@@ -1003,7 +1003,7 @@
               "ID": "CVE-2021-21166",
               "CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
               "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
-              "CWE": "NVD-CWE-Other",
+              "CWE": "CWE-362",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-21166",
               "Impact": "High",
               "Public": "20210309"

oval/p10/ALT-PU-2024-6851/definitions.json

@@ -64,7 +64,7 @@
         "Description": "This update upgrades freerdp to version 2.11.6-alt1. \nSecurity Fix(es):\n\n * CVE-2024-32039: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with `/bpp:32` or `/rfx` as it is on by default).\n\n * CVE-2024-32040: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).\n\n * CVE-2024-32041: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.\n\n * CVE-2024-32458: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).\n\n * CVE-2024-32459: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. No known workarounds are available.\n\n * CVE-2024-32460: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths (e.g. `/rfx` or `/gfx` options). The workaround requires server side support.",
         "Advisory": {
           "From": "errata.altlinux.org",
-          "Severity": "Low",
+          "Severity": "Critical",
           "Rights": "Copyright 2024 BaseALT Ltd.",
           "Issued": {
             "Date": "2024-04-19"
@@ -76,38 +76,50 @@
           "CVEs": [
             {
               "ID": "CVE-2024-32039",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-787",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32039",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32040",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-191",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32040",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32041",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-125",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32041",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32458",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-125",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32458",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32459",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-125",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32459",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32460",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-125",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32460",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             }
           ],

oval/p11/ALT-PU-2021-1460/definitions.json

@@ -826,7 +826,7 @@
               "ID": "CVE-2021-21166",
               "CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
               "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
-              "CWE": "NVD-CWE-Other",
+              "CWE": "CWE-362",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-21166",
               "Impact": "High",
               "Public": "20210309"

oval/p11/ALT-PU-2021-1668/definitions.json

@@ -996,7 +996,7 @@
               "ID": "CVE-2021-21166",
               "CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
               "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
-              "CWE": "NVD-CWE-Other",
+              "CWE": "CWE-362",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-21166",
               "Impact": "High",
               "Public": "20210309"

oval/p11/ALT-PU-2024-6812/definitions.json

@@ -57,7 +57,7 @@
         "Description": "This update upgrades freerdp3 to version 3.5.0-alt1. \nSecurity Fix(es):\n\n * CVE-2024-32039: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with `/bpp:32` or `/rfx` as it is on by default).\n\n * CVE-2024-32040: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).\n\n * CVE-2024-32041: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.\n\n * CVE-2024-32458: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).\n\n * CVE-2024-32459: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. No known workarounds are available.\n\n * CVE-2024-32460: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths (e.g. `/rfx` or `/gfx` options). The workaround requires server side support.",
         "Advisory": {
           "From": "errata.altlinux.org",
-          "Severity": "Low",
+          "Severity": "Critical",
           "Rights": "Copyright 2024 BaseALT Ltd.",
           "Issued": {
             "Date": "2024-04-18"
@@ -69,38 +69,50 @@
           "CVEs": [
             {
               "ID": "CVE-2024-32039",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-787",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32039",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32040",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-191",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32040",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32041",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-125",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32041",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32458",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-125",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32458",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32459",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-125",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32459",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32460",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-125",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32460",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             }
           ],

oval/p11/ALT-PU-2024-6814/definitions.json

@@ -57,7 +57,7 @@
         "Description": "This update upgrades freerdp to version 2.11.6-alt1. \nSecurity Fix(es):\n\n * CVE-2024-32039: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with `/bpp:32` or `/rfx` as it is on by default).\n\n * CVE-2024-32040: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).\n\n * CVE-2024-32041: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.\n\n * CVE-2024-32458: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).\n\n * CVE-2024-32459: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. No known workarounds are available.\n\n * CVE-2024-32460: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths (e.g. `/rfx` or `/gfx` options). The workaround requires server side support.",
         "Advisory": {
           "From": "errata.altlinux.org",
-          "Severity": "Low",
+          "Severity": "Critical",
           "Rights": "Copyright 2024 BaseALT Ltd.",
           "Issued": {
             "Date": "2024-04-18"
@@ -69,38 +69,50 @@
           "CVEs": [
             {
               "ID": "CVE-2024-32039",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-787",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32039",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32040",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-191",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32040",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32041",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-125",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32041",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32458",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-125",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32458",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32459",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-125",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32459",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             },
             {
               "ID": "CVE-2024-32460",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+              "CWE": "CWE-125",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-32460",
-              "Impact": "None",
+              "Impact": "Critical",
               "Public": "20240422"
             }
           ],

oval/p11/ALT-PU-2025-1154/definitions.json

@@ -69,7 +69,7 @@
             "Source": "CVE"
           }
         ],
-        "Description": "This update upgrades firefox-esr to version 128.6.0-alt1. \nSecurity Fix(es):\n\n * BDU:2025-00154: Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с использованием памяти после ее освобождения, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2025-00156: Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю выполнить произвольный код\n\n * CVE-2025-0237: The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0238: Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Firefox ESR \u003c 115.19, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0239: When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0240: Parsing a JavaScript module as JSON could under some circumstances cause cross-compartment access, which may result in a use-after-free. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0241: When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0242: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Firefox ESR \u003c 115.19, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0243: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.",
+        "Description": "This update upgrades firefox-esr to version 128.6.0-alt1. \nSecurity Fix(es):\n\n * BDU:2025-00154: Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с использованием памяти после ее освобождения, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2025-00156: Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю выполнить произвольный код\n\n * CVE-2025-0237: The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0238: Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Firefox ESR \u003c 115.19, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0239: When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0240: Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0241: When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0242: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Firefox ESR \u003c 115.19, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0243: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.",
         "Advisory": {
           "From": "errata.altlinux.org",
           "Severity": "Low",

oval/p11/ALT-PU-2025-1972/definitions.json

@@ -74,7 +74,7 @@
             "Source": "CVE"
           }
         ],
-        "Description": "This update upgrades thunderbird to version 128.6.0-alt1. \nSecurity Fix(es):\n\n * BDU:2025-00154: Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с использованием памяти после ее освобождения, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2025-00156: Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю выполнить произвольный код\n\n * CVE-2024-50336: matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. Fixed in matrix-js-sdk 34.11.1.\n\n * CVE-2025-0237: The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0238: Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Firefox ESR \u003c 115.19, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0239: When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0240: Parsing a JavaScript module as JSON could under some circumstances cause cross-compartment access, which may result in a use-after-free. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0241: When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0242: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Firefox ESR \u003c 115.19, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0243: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.",
+        "Description": "This update upgrades thunderbird to version 128.6.0-alt1. \nSecurity Fix(es):\n\n * BDU:2025-00154: Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с использованием памяти после ее освобождения, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2025-00156: Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю выполнить произвольный код\n\n * CVE-2024-50336: matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. Fixed in matrix-js-sdk 34.11.1.\n\n * CVE-2025-0237: The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0238: Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Firefox ESR \u003c 115.19, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0239: When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0240: Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0241: When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0242: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Firefox ESR \u003c 115.19, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0243: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.",
         "Advisory": {
           "From": "errata.altlinux.org",
           "Severity": "Low",

oval/p11/ALT-PU-2025-1984/definitions.json

@@ -89,7 +89,7 @@
             "Source": "CVE"
           }
         ],
-        "Description": "This update upgrades firefox to version 134.0.2-alt1. \nSecurity Fix(es):\n\n * BDU:2025-00154: Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с использованием памяти после ее освобождения, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2025-00156: Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю выполнить произвольный код\n\n * CVE-2025-0237: The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0238: Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Firefox ESR \u003c 115.19, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0239: When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0240: Parsing a JavaScript module as JSON could under some circumstances cause cross-compartment access, which may result in a use-after-free. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0241: When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0242: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Firefox ESR \u003c 115.19, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0243: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0244: When redirecting to an invalid protocol scheme, an attacker could spoof the address bar. \n*Note: This issue only affected Android operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox \u003c 134.\n\n * CVE-2025-0245: Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed. This vulnerability affects Firefox \u003c 134.\n\n * CVE-2025-0246: When using an invalid protocol scheme, an attacker could spoof the address bar. \n*Note: This issue only affected Android operating systems. Other operating systems are unaffected.*\n*Note: This issue is a different issue from CVE-2025-0244. This vulnerability affects Firefox \u003c 134.\n\n * CVE-2025-0247: Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 134 and Thunderbird \u003c 134.",
+        "Description": "This update upgrades firefox to version 134.0.2-alt1. \nSecurity Fix(es):\n\n * BDU:2025-00154: Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с использованием памяти после ее освобождения, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2025-00156: Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю выполнить произвольный код\n\n * CVE-2025-0237: The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0238: Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Firefox ESR \u003c 115.19, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0239: When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0240: Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0241: When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0242: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Firefox ESR \u003c 115.19, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0243: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 134, Firefox ESR \u003c 128.6, Thunderbird \u003c 134, and Thunderbird \u003c 128.6.\n\n * CVE-2025-0244: When redirecting to an invalid protocol scheme, an attacker could spoof the address bar. \n*Note: This issue only affected Android operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox \u003c 134.\n\n * CVE-2025-0245: Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed. This vulnerability affects Firefox \u003c 134.\n\n * CVE-2025-0246: When using an invalid protocol scheme, an attacker could spoof the address bar. \n*Note: This issue only affected Android operating systems. Other operating systems are unaffected.*\n*Note: This issue is a different issue from CVE-2025-0244. This vulnerability affects Firefox \u003c 134.\n\n * CVE-2025-0247: Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 134 and Thunderbird \u003c 134.",
         "Advisory": {
           "From": "errata.altlinux.org",
           "Severity": "Low",

oval/p9/ALT-PU-2021-1511/definitions.json

@@ -832,7 +832,7 @@
               "ID": "CVE-2021-21166",
               "CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
               "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
-              "CWE": "NVD-CWE-Other",
+              "CWE": "CWE-362",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-21166",
               "Impact": "High",
               "Public": "20210309"

oval/p9/ALT-PU-2021-1751/definitions.json

@@ -1002,7 +1002,7 @@
               "ID": "CVE-2021-21166",
               "CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
               "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
-              "CWE": "NVD-CWE-Other",
+              "CWE": "CWE-362",
               "Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-21166",
               "Impact": "High",
               "Public": "20210309"