CVE-2023-28366

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function...

CVE-2023-28366

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function...

Memory corruption

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function...

Fedora 37 : mosquitto (2023-e7ed15ab9e)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-e7ed15ab9e advisory. 2.0.17 Broker: Fix maxqueuedmessages 0 stopping clients from receiving messages Fix maxinflightmessages not being set correctly. Apps: Fix...

CVE-2023-28366

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function...

CVE-2023-28366

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function...

CVE-2023-28366

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function...

CVE-2023-28366

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function...

Ubuntu 20.04 LTS : Linux kernel (GCP) vulnerabilities (USN-6330-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6330-1 advisory. Daniel Moghimi discovered that some IntelR Processors did not properly clear microarchitectural state after speculative execution of various instructions...

CVE-2023-28366

CVE-2023-28366 affects the Eclipse Mosquitto broker (versions 1.3.2–2.x prior to 2.0.16). The issue is a memory leak caused by mishandling of EAGAIN from libc send when a client sends many QoS 2 messages with duplicate message IDs and the broker does not respond to PUBREC. This can enable remote ...

Ubuntu 18.04 ESM : Linux kernel vulnerabilities (USN-6329-1)

The remote Ubuntu 18.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6329-1 advisory. Daniel Moghimi discovered that some IntelR Processors did not properly clear microarchitectural state after speculative execution of various instructions...

passt bug fix update

An update is available for passt. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list passt implements a translation layer between a Layer-2 network interface and...

Ubuntu 20.04 LTS : Linux kernel (GKE) vulnerabilities (USN-6324-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6324-1 advisory. Daniel Moghimi discovered that some IntelR Processors did not properly clear microarchitectural state after speculative execution of various instructions...

Oracle Linux 7 : kernel (ELSA-2023-4819)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-4819 advisory. - debug: lock down kgdb Orabug: 34270798 CVE-2022-21499 - x86/cpu/amd: Add a Zenbleed fix Waiman Long 2226841 CVE-2023-20593 - x86/cpu/amd: Move the...

SUSE SLES15: xen / xen-devel / xen-libs / xen-tools / xen-tools-domU / etc (SUSE-SU-2023:3496-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3496-1 advisory. Update to Xen 4.13.5 bug fix release bsc1027519. - CVE-2023-20569: Fixed x86/AMD Speculative Return Stack Overflow XSA-434...

Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-6325-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6325-1 advisory. Daniel Moghimi discovered that some IntelR Processors did not properly clear microarchitectural state after speculative execution of various...

SUSE SLES15 Security Update : xen (SUSE-SU-2023:3494-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3494-1 advisory. - CVE-2023-20569: Fixed x86/AMD Speculative Return Stack Overflow XSA-434 bsc1214082. - CVE-2022-40982: Fixed x86/Intel Gather Data...

CVE-2023-36054 affecting package krb5 for versions less than 1.19.4-2

CVE-2023-36054 affecting package krb5 for versions less than 1.19.4-2. A patched version of the package is available...

OSV-2023-764 Heap-buffer-overflow in pim_pim_packet

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61854 Crash type: Heap-buffer-overflow READ 2 Crash state: pimpimpacket pimmain.c...

Ubuntu 23.04 : Linux kernel vulnerabilities (USN-6321-1)

The remote Ubuntu 23.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6321-1 advisory. Daniel Moghimi discovered that some IntelR Processors did not properly clear microarchitectural state after speculative execution of various instructions. A...