UBUNTU-CVE-2024-56575

In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Ensure power suppliers be suspended before detach them The power suppliers are always requested to suspend asynchronously, devpmdomaindetach requires the caller to ensure proper synchronization of this function...

CVE-2024-56655 netfilter: nf_tables: do not defer rule destruction via call_rcu

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: do not defer rule destruction via callrcu nftableschaindestroy can sleep, it can't be used from callrcu callbacks. Moreover, nftablesrulerelease is only safe for error unwinding, while transaction mutex is he...

CVE-2024-56575 media: imx-jpeg: Ensure power suppliers be suspended before detach them

In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Ensure power suppliers be suspended before detach them The power suppliers are always requested to suspend asynchronously, devpmdomaindetach requires the caller to ensure proper synchronization of this function...

DEBIAN-CVE-2024-53203

In the Linux kernel, the following vulnerability has been resolved: usb: typec: fix potential array underflow in ucsiccgsynccontrol The "command" variable can be controlled by the user via debugfs. The worry is that if conindex is zero then "&uc-ucsi-connectorconindex - 1" would be an array...

The vulnerability of the NuGet package management system, related to synchronization errors when using a shared resource, allows a hacker to execute arbitrary code.

The vulnerability of the NuGet package management system is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker operating remotely to execute arbitrary code...

The vulnerability of the Apache Tomcat application server, related to synchronization errors when using shared resources, allows attackers to execute arbitrary code.

The vulnerability of the Apache Tomcat application server is related to synchronization errors when using a shared resource, due to the lack of consideration for registrations in the file system during the writing of servlets. Exploiting this vulnerability allows an attacker operating remotely to...

The Windows Registry Adventure #5: The regf file format

Posted by Mateusz Jurczyk, Google Project Zero As previously mentioned in the second installment of the blog post series "A brief history of the feature", the binary format used to encode registry hives from Windows NT 3.1 up to the modern Windows 11 is called regf. In a way, it is quite special,...

The vulnerability of the DefaultServlet server servlet in the Apache Tomcat application server allows a attacker to execute arbitrary code.

The vulnerability of the DefaultServlet server component in the Apache Tomcat application server is related to synchronization errors when using shared resources „Race Conditions“. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the data analysis tool from IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data arises due to synchronization errors when using a shared resource, allowing a malicious actor to trigger a service failure.

The vulnerability of the IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data data analysis service lies in synchronization errors when using a shared resource. Exploiting this vulnerability can allow a malicious actor to cause a service failure...

USN-7166-1 linux, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-raspi vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - RISC-V architecture; - S390 architecture; - x86 architecture; - Block layer subsystem; - ACPI...

The vulnerability of the Cloud Files Mini Filter Driver for Microsoft Windows operating systems allows a hacker to increase their privileges.

The vulnerability of the Cloud Files Mini Filter Driver for Microsoft Windows operating systems is related to synchronization errors. Exploiting this vulnerability can allow attackers to gain increased privileges...

The vulnerability of the BLE (Bluetooth Low Energy) component of the microprogramming software for monitoring and controlling energy systems in Sentron Powercenter 1000/1100 allows a intruder to trigger a service failure.

The vulnerability of the BLE Bluetooth Low Energy component of the microprogramming software for monitoring and controlling energy systems in Sentron Powercenter 1000/1100 is related to synchronization errors. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the kernel of Microsoft Windows, which allows a hacker to increase their privileges

The vulnerability of the kernel of Microsoft Windows is related to synchronization errors when using a shared resource „Race Conditions“. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability in the implementation of the LDAP service protocol for Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the LDAP Lightweight Directory Access Protocol implementation in Windows operating systems is related to synchronization errors when using a shared resource. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

The vulnerability of Intel microprogramming software, related to synchronization errors in control logic, allows attackers to exploit this to disclose protected information.

The vulnerability of Intel microprogramming software is related to synchronization errors in the control logic. Exploiting this vulnerability can allow an attacker to disclose protected information...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-50041)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-50041 advisory. - In the Linux kernel, the following vulnerability has been resolved: i40e: Fix macvlan leak by synchronizing...

i40e: fix race condition by adding filter's intermediate sync state

...

PT-2024-9423 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a Lightweight Directory Access Protocol LDAP client remote code execution. It is caused by synchronization errors when using a shared resource. This allows a remote...

PT-2024-9528 · Microsoft · Windows Cloud Files Mini Filter Driver +1

Name of the Vulnerable Software and Affected Versions: Windows Cloud Files Mini Filter Driver affected versions not specified Description: The issue is related to an elevation of privilege vulnerability in the Windows Cloud Files Mini Filter Driver, which is associated with synchronization errors...

Log Injection

org.apache.nifi, nifi is vulnerable to Log Injection. The vulnerability is due to the optional debug logging feature, which allows an authorized administrator to enable detailed logging of Parameter Context values during flow synchronization...