CVE-2023-28746 Affecting rv package, versions <0:5.14.0-427.40.1.el9_4
Threat Intelligence
EPSS
0.04% (12th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-ALMALINUX9-RV-8304893
- published 25 Oct 2024
- disclosed 16 Oct 2024
Introduced: 16 Oct 2024
CVE-2023-28746 Open this link in a new tabHow to fix?
Upgrade AlmaLinux:9 rv to version 0:5.14.0-427.40.1.el9_4 or higher.
This issue was patched in ALSA-2024:8162.
NVD Description
Note: Versions mentioned in the description apply only to the upstream rv package and not the rv package as distributed by AlmaLinux.
See How to fix? for AlmaLinux:9 relevant fixed versions and status.
Information exposure through microarchitectural state after transient execution from some register files for some Intel(R) Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
References
- https://errata.almalinux.org/8/ALSA-2024-5101.html
- https://errata.almalinux.org/9/ALSA-2024-8162.html
- https://access.redhat.com/security/cve/CVE-2023-28746
- https://access.redhat.com/errata/RHSA-2024:5101
- https://access.redhat.com/errata/RHSA-2024:8162
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00898.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZON4TLXG7TG4A2XZG563JMVTGQW4SF3A/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H63LGAQXPEVJOES73U4XK65I6DASOAAG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EIUICU6CVJUIB6BPJ7P5QTPQR5VOBHFK/
- http://www.openwall.com/lists/oss-security/2024/03/12/13
- https://lists.debian.org/debian-lts-announce/2024/05/msg00003.html
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
CVSS Scores
version 3.1