Ubuntu: Security Advisory (USN-5545-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GSD-2022-1003183 x86/fpu: KVM: Set the base guest FPU uABI size to sizeof(struct kvm_xsave)

x86/fpu: KVM: Set the base guest FPU uABI size to sizeofstruct kvmxsave This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.13 by commit...

Ubuntu: Security Advisory (USN-5471-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated nvidia390 packages fix security vulnerabilities

Updated nvidia390 packages fix security vulnerabilities: NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer, where an unprivileged regular user on the network can cause an out-of-bounds write through a specially crafted shader, which may lead to code execution, denial of...

CVE-2022-29936

CVE-2022-29936 concerns USU Oracle Optimization prior to 5.17. The vulnerability arises from Java deserialization of the file path /v2/quantum/save-data-upload-big-file, enabling remote code execution. Public descriptions specify that authenticated users (described as quantum users in some source...

Linux Improves Its Random Number Generator

In kernel version 5.17, both /dev/random and /dev/urandom have been replaced with a new -- identical -- algorithm based on the BLAKE2 hash function, which is an excellent security improvement...

A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVM_XEN_HVM_SET_ATTR ioctl. This flaw affects Linux kernel versions prior to 5.17-rc1.

...

Linux kernel map_get_next_key function denial of service vulnerability

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. BPF in versions prior to Linux kernel 5.17-rc1 has a denial-of-service vulnerability that stems from the mapgetnextkey function forcing dereference of NULL pointer on the Linux kernel, which can be...

DEBIAN-CVE-2021-4095

A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVMXENHVMSETATTR ioctl. This fl...

CVE-2021-4095

A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVMXENHVMSETATTR ioctl. This fl...

CVE-2021-4095

A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVMXENHVMSETATTR ioctl. This fl...

CVE-2021-4095

A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVMXENHVMSETATTR ioctl. This fl...

PT-2022-7620 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.17 Description: The issue is related to a memory leak in the lcd2s component of the Linux kernel. This leak occurs because the struct lcd2s data is never freed once allocated. The problem can be fixed by...

DEBIAN-CVE-2022-0617

A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udffilewriteiter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2...

Design/Logic Flaw

An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC protocol subsystem, in the way a user sends a TIPC datagram to one or more destinations. This flaw allows a local user to read some kernel memory. This issue is limited to no more than 7 bytes, and the user...

CVE-2022-0382

An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC protocol subsystem, in the way a user sends a TIPC datagram to one or more destinations. This flaw allows a local user to read some kernel memory. This issue is limited to no more than 7 bytes, and the user...

PT-2022-7357 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 5.17-rc1 through 5.17-rc5 Description: A flaw in the Linux kernel Management Component Transport Protocol MCTP subsystem was found, related to use after free. This issue can be triggered by a local user, allowing them to...

PT-2022-2006

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.17-rc8 Description An out-of-bounds OOB memory write flaw exists in the watch queue event notification subsystem. This issue allows a local user to overwrite parts of the kernel state, which can lead to a denia...

Unspecified Vulnerability in Mattermost Server (CNVD-2020-35357)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 5.17.0, which can be exploited by a remote attacker to cause a denial of service client application crash with LaTeX messages...

Alstrasoft EPay Enterprise 5.17 - SQL Injection

Alstrasoft EPay Enterprise 5.17 - SQL Injection Exploit Title: Alstrasoft EPay Enterprise v5.17 Script - SQL Injection Google Dork: N/A Date: 04.02.2017 Vendor Homepage: http://www.alstrasoft.com/ Software Buy: http://www.alstrasoft.com/epayenterprise.htm Demo: http://blizsoft.com/enterprise/...