CVE-2024-35843

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Use device rbtree in iopf reporting path The existing I/O page fault handler currently locates the PCI device by calling pcigetdomainbusandslot. This function searches the list of all PCI devices until the desired...

DEBIAN-CVE-2024-35815

In the Linux kernel, the following vulnerability has been resolved: fs/aio: Check IOCBAIORW before the struct aiokiocb conversion The first kiocbsetcancelfn argument may point at a struct kiocb that is not embedded inside struct aiokiocb. With the current code, depending on the compiler, the...

Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to multiple vulnerabilities

Summary There are multiple vulnerabilities in components of IBM i Modernization Engine for Lifecycle Integration as described in the Vulnerability Details section. Node.js follow-redirects module could allow a remote authenticated attacker to obtain sensitive information CVE-2024-28849,...

Security Bulletin: IBM HTTP Server (powered by Apache) for IBM i is vulnerable to a denial of service attack using HTTP/2 protocol. [CVE-2023-44487]

Summary IBM HTTP Server powered by Apache used by IBM i is vulnerable to a denial of service attack due to mishandling of multiplexed streams in HTTP/2 protocol as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerability as described ...

JVN#83405304: "OfferBox" App uses a hard-coded secret key

"OfferBox" App provided by i-plug inc. uses a hard-coded secret key for JWT CWE-321. Impact The hard-coded secret key for JWT may be retrieved if the application binary is reverse-engineered. Solution The hard-coded secret key has been revoked by the developer on May 8, 2024 therefore this...

PT-2024-5316 · Ibm · Ibm I

Name of the Vulnerable Software and Affected Versions: IBM i versions 7.3 through 7.5 Description: The issue is related to errors in access restriction in the TCP/IP Connectivity Utilities component of the IBM i operating system. A malicious actor with command line access to the host operating...

Huawei EulerOS: Security Advisory for libuv (EulerOS-SA-2024-1594)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for libuv (EulerOS-SA-2024-1572)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-34473

An issue was discovered in appmgr in O-RAN Near-RT RIC I-Release. An attacker could register an unintended RMR message type during xApp registration to disrupt other service components...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a mapping disclosure vulnerability in MMIO...

CVE-2024-34045

The O-RAN E2T I-Release Prometheus metric Increment function can crash in sctpThread.cpp for message.peerInfo-countersININITIMSGCOUNTERProcedureCodeidE2setup-Increment...

CVE-2024-34043

O-RAN RICAPP kpimon-go I-Release has a segmentation violation via a certain E2AP-PDU message...

CVE-2024-34044

The O-RAN E2T I-Release buildPrometheusList function can have a NULL pointer dereference because peerInfo can be NULL...

CVE-2024-34047

O-RAN RIC I-Release e2mgr lacks array size checks in RicServiceUpdateHandler...

CVE-2024-34043

O-RAN RICAPP kpimon-go I-Release has a segmentation violation via a certain E2AP-PDU message...

PT-2024-25665 · O Ran · O-Ran Ric I-Release E2Mgr

Name of the Vulnerable Software and Affected Versions: O-RAN RIC I-Release e2mgr affected versions not specified Description: The issue is related to a lack of array size checks in the E2nodeConfigUpdateNotificationHandler of the O-RAN RIC I-Release e2mgr. No information is provided about the...

CVE-2024-34043

CVE-2024-34043 affects O-RAN RICAPP kpimon-go I-Release. The vulnerability is a segmentation violation triggered by a certain E2AP-PDU message in that release. Documented impact notes are low severity with local access and minimal user interaction (CVSS v3.1 base score 5.3). Connected sources (Re...

CVE-2024-34047

O-RAN RIC I-Release e2mgr lacks array size checks in RicServiceUpdateHandler...

CVE-2024-34043

O-RAN RICAPP kpimon-go I-Release has a segmentation violation via a certain E2AP-PDU message...

PT-2024-25664 · O Ran · O-Ran Ric I-Release E2Mgr

Name of the Vulnerable Software and Affected Versions: O-RAN RIC I-Release e2mgr affected versions not specified Description: The issue is related to a lack of array size checks in the RicServiceUpdateHandler of the O-RAN RIC I-Release e2mgr. Recommendations: At the moment, there is no informatio...