SUSE SLES15: cluster-md-kmp-azure / dlm-kmp-azure / gfs2-kmp-azure / etc (SUSE-SU-2023:1802-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1802-1 advisory. The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes. The following...

CVE-2023-28466

creationtimestamp| type| source ---|---|--- 2023-03-16 06:30:20+00:00| seen| https://t.me/cibsecurity/60100...

CVE-2023-28466

dotlsgetsockopt in net/tls/tlsmain.c in the Linux kernel through 6.2.6 lacks a locksock call, leading to a race condition with a resultant use-after-free or NULL pointer dereference...

CVE-2023-28466

dotlsgetsockopt in net/tls/tlsmain.c in the Linux kernel through 6.2.6 lacks a locksock call, leading to a race condition with a resultant use-after-free or NULL pointer dereference...

DEBIAN-CVE-2023-28466

dotlsgetsockopt in net/tls/tlsmain.c in the Linux kernel through 6.2.6 lacks a locksock call, leading to a race condition with a resultant use-after-free or NULL pointer dereference...

AZL-25661 CVE-2023-28466 affecting package kernel for versions less than 5.15.107.1-2

dotlsgetsockopt in net/tls/tlsmain.c in the Linux kernel through 6.2.6 lacks a locksock call, leading to a race condition with a resultant use-after-free or NULL pointer dereference...

CVE-2023-28466

dotlsgetsockopt in net/tls/tlsmain.c in the Linux kernel through 6.2.6 lacks a locksock call, leading to a race condition with a resultant use-after-free or NULL pointer dereference...

CVE-2023-28466

Summary: CVE-2023-28466 affects the Linux kernel up to 6.2.6, where do_tls_getsockopt in net/tls/tls_main.c can race due to a missing lock_sock, causing a use-after-free or NULL pointer dereference. The condition is a local, kernel‑level issue with potential crashes or memory corruption as descri...

CVE-2023-28466

dotlsgetsockopt in net/tls/tlsmain.c in the Linux kernel through 6.2.6 lacks a locksock call, leading to a race condition with a resultant use-after-free or NULL pointer dereference...

CVE-2021-28466

Raw Image Extension Remote Code Execution Vulnerability...

CVE-2021-28466

CVE-2021-28466 is a Raw Image Extension RCE affecting Windows Raw Image Extensions. Public docs attribute the root cause to incorrect code-generation management in the Raw Image Extension component, enabling arbitrary code execution when processing specially crafted content. Exploitation paths ar...

CVE-2021-28466 Raw Image Extension Remote Code Execution Vulnerability

...

Microsoft Windows Raw Image Extensions Library RCEs (April 2021)

The Windows 'Raw Image Extensions' app installed on the remote host is affected by multiple remote code execution vulnerabilities: - A remote code execution vulnerability exists in the Microsoft Windows Codecs Library Raw Image. An attacker who successfully exploited the vulnerability could execu...

CVE-2020-28466

This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightene...

CVE-2020-28466

CVE-2020-28466 affects the nats-server component at github.com/nats-io/nats-server/server. The issue arises from an export/import cycle between accounts that untrusted users can trigger, causing the server to crash (denial of service) by consuming CPU/memory. Connected advisories indicate the 2.x...