CVE-2023-52606 powerpc/lib: Validate size for vector operations

In the Linux kernel, the following vulnerability has been resolved: powerpc/lib: Validate size for vector operations Some of the fp/vmx code in sstep.c assume a certain maximum size for the instructions being emulated. The size of those operations however is determined separately in analyseinstr...

CVE-2023-52606

CVE-2023-52606 affects the Linux kernel’s powerpc/lib path, where the sstep.c FP/VMX vector operation size assumption was not consistently enforced. The underlying issue: analyse_instr() determines operation size separately, risking kernel stack corruption when the assumption is violated. The fix...

kernel security update

4.18.0-513.18.1.el89.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32...

CVE-2023-52606: Allocation of Resources Without Limits or Throttling

In the Linux kernel, the following vulnerability has been resolved: powerpc/lib: Validate size for vector operations Some of the fp/vmx code in sstep.c assume a certain maximum size for the instructions being emulated. The size of those operations however is determined separately in analyseinstr...

Privilege Escalation

app-builder-lib is vulnerable to Privilege escalation. The vulnerability is due to NSExec searching the current directory of the installer before searching the system's PATH when making a system call to open cmd.exe in the .nsh installer script. This flaw allows an attacker to exploit the situati...

@attq/blackboox (>=0.4.0, <=0.5.5), @overwolf/ow-electron-builder (>=24.7.0-beta.0, <=24.7.0) +11 more potentially affected by CVE-2024-27303 via app-builder-lib (>=24.0.0-alpha.1, <=24.13.1)

app-builder-lib NPM version =24.0.0-alpha.1, =0.4.0, =24.7.0-beta.0, =1.0.0-canary.0, =24.6.3, =24.0.0-alpha.1, =24.0.0-alpha.1, =24.0.0-alpha.1, =1.0.0, =24.0.0-alpha.1, =24.0.0-alpha.1, =24.0.0-alpha.1, =24.0.0-alpha.1, =24.13.1 Source cves: CVE-2024-27303 Source advisory: OSV:GHSA-R4PF-3V7R-HH...

Spoofing

In the Linux kernel, the following vulnerability has been resolved: ALSA: rawmidi - fix the uninitalized userpversion The userpversion was uninitialized for the user space file structure in the open function, because the file private structure use kmalloc for the allocation. The kernel ALSA...

openSUSE: Security Advisory for nodejs18 (SUSE-SU-2023:0419-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the Task Manager module of the VitalPBX unified communication system allows a hacker to execute arbitrary commands.

The vulnerability of the Task Manager module of the VitalPBX unified communication system is related to errors in access control due to insufficient protection of service data during script processing from the /var/lib/vitalpbx directory. Exploiting this vulnerability allows a remote attacker to...

External Control Of Filename

phenx/php-svg-lib is vulnerable to External Control of Filename. The vulnerability is due to insecure handling of inline CSS font definitions, allowing an attacker to deserialize a PHAR file through the phar:// URL handler. Note that remote code execution is only possible on PHP versions less the...

Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerability (USN-6650-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6650-1 advisory. Zhenghan Wang discovered that the generic ID allocator implementation in the Linux kernel did not properly check for null bitmap when releasing IDs. A local...

GHSA-97M3-52WR-XVV2 Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE

Summary A lack of sanitization/check in the font path returned by php-svg-lib, in the case of a inline CSS font defined, that will be used by Cpdf to open a font will be passed to a fileexists call, which is sufficient to trigger metadata unserializing on a PHAR file, through the phar:// URL...

Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE

Summary A lack of sanitization/check in the font path returned by php-svg-lib, in the case of a inline CSS font defined, that will be used by Cpdf to open a font will be passed to a fileexists call, which is sufficient to trigger metadata unserializing on a PHAR file, through the phar:// URL...

CVE-2024-25828: Path Traversal: 'dir/../../filename'

cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/templateadmin.php...

CVE-2024-25828

The cmseasy content management system (CMS), version V7.7.7.9 , contains an arbitrary file deletion vulnerability within the lib/admin/template_admin.php component. This flaw allows for the unauthorized deletion of files on the server. While there is no official patch version currently documented...

CVE-2024-25828

cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/templateadmin.php...

CVE-2024-1750: Deserialization of Untrusted Data

A vulnerability, which was classified as critical, was found in TemmokuMVC up to 2.3. Affected is the function getimgurl/imgreplace in the library lib/imagesgetdown.php of the component Image Download Handler. The manipulation leads to deserialization. It is possible to launch the attack remotely...

php-svg-lib lacks path validation on font through SVG inline styles

Summary php-svg-lib fails to validate that font-family doesn't contain a PHAR url, which might leads to RCE on PHP href, 0, 7 === "phar://" || $this-document-allowExternalReferences === false && \strtolower\substr$this-href, 0, 5 !== "data:" unset$style"font-family"; PoC Parsing the following SVG...

DEBIAN-CVE-2024-25117

php-svg-lib is a scalable vector graphics SVG file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't contain a PHAR url, which might leads to RCE on PHP 8.0, and doesn't validate if external references are allowed. This might leads to bypass...

CVE-2024-25117

php-svg-lib is a scalable vector graphics SVG file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't contain a PHAR url, which might leads to RCE on PHP 8.0, and doesn't validate if external references are allowed. This might leads to bypass...