New Vulnerabilities Monday 29 January

New Alerts for FFmpeg, SE-elektronic, TRUMPF, Dell, HP, Juniper Networks, and Linux.

FFmpeg 

Two vulnerabilities in FFmpeg allow a remote attacker to conduct RCE and achieve DoS. Highest CVSSv3 score of 9.8
More info. And here.

E-DDC3.3 contains 2 vulnerabilities, one of which could allow a remote attacker to achieve RCE. Highest CVSSv3 score of 9.8
No response from vendor.
More info.

CAD/CAM tools use the vulnerable CodeMeter Runtime from WIBU. CVSSv3 score of 9.8
More info.

Dell vRealize Data Protection Extension for VMware Aria Automation contains the most recent Aria Automation vulnerability. CVSSv3 score of 9.9
More info.

HP ThinPro and HP Device Manager contain vulnerabilities in third-party software. Highest CVSSv3 score of 9.8
More info. And here.

Juniper has published an Out-of-Cycle bulletin for Junos OS on SRX and EX Series identifying several vulnerabilities including Missing Authentication, and Improper Neutralization. Highest CVSSv3 score of 8.8
More info.

An Improper Validation of Integrity Check Value vulnerability in Junos OS and Junos OS Evolved allows a remote attacker to bypass integrity checks. CVSSv3 score of 3.7
More info.

CentOS 7 has updated the kernel. More info.
Oracle Linux has updated the kernel. More info.
Alpine Linux has published Alpine 3.19.1. More info.