OESA-2024-2354 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

Medium: python

Issue Overview: The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which...

Medium: python3

Issue Overview: The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which...

BIT-PYTHON-2023-27043

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is...

CVE-2022-48954 s390/qeth: fix use-after-free in hsci

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: fix use-after-free in hsci KASAN found that addr was dereferenced after br2deveventwork was freed. ================================================================== BUG: KASAN: use-after-free in...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: Fix showrcutaskstracegpkthread buffer overflow CVE-2024-38577 In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's dname.name CVE-2024-39494 In the...

CVE-2024-44941

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to cover read extent cache access with lock syzbot reports a f2fs bug as below: BUG: KASAN: slab-use-after-free in sanitycheckextentcache+0x370/0x410 fs/f2fs/extentcache.c:46 Read of size 4 at addr ffff8880739ab220 by...

CVE-2022-48919 cifs: fix double free race when mount fails in cifs_get_root()

In the Linux kernel, the following vulnerability has been resolved: cifs: fix double free race when mount fails in cifsgetroot When cifsgetroot fails during cifssmb3domount we call deactivatelockedsuper which eventually will call delayedfree which will free the context. In this situation we shoul...

CVE-2024-43878

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix input error path memory access When there is a misconfiguration of input state slow path KASAN report error. Fix this error. west login: 52.987278 eth1: renamed from veth11 53.078814 eth1: renamed from veth21 53.181355...

CVE-2024-43849 soc: qcom: pdr: protect locator_addr with the main mutex

In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pdr: protect locatoraddr with the main mutex If the service locator server is restarted fast enough, the PDR can rewrite locatoraddr fields concurrently. Protect them by placing modification of those fields under the...

CVE-2024-42154

A vulnerability was found in the Linux kernel's tcpmetrics.c, where insufficient validation of the length of the source address for TCP metrics could lead to incorrect memory read out of boundary read. Mitigation Mitigation for this issue is either not available or the currently available options...

DEBIAN-CVE-2024-42123

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix double free erraddr pointer warnings In amdgpuumcbadpagepollingtimeout, the amdgpuumchandlebadpages will be run many times so that double free erraddr in some special case. So set the erraddr to NULL to avoid the...

CVE-2024-42154

In the Linux kernel, the following vulnerability has been resolved: tcpmetrics: validate source addr length I don't see anything checking that TCPMETRICSATTRSADDRIPV4 is at least 4 bytes long, and the policy doesn't have an entry for this attribute at all neither does it for IPv6 but v6 is manual...

CVE-2024-42154

CVE-2024-42154 : In the Linux kernel, the vulnerability is in tcp_metrics: validate source addr length. The issue is that TCP_METRICS_ATTR_SADDR_IPV4 may be stored with fewer than 4 bytes and the policy lacks an entry for this attribute (IPv6 similarly manually validated). Root cause: missing len...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that originates in the drm/amdgpu module in the amdgpuumcbadpagepollingtimeout, where amdgpuumchandlebadpages may be run...

kernel: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr

This CVE addresses a race condition in the Linux kernel's IPv6 subsystem, specifically between the ipv6getifaddr and ipv6deladdr functions. This race condition can lead to use-after-free scenarios, potentially causing system instability or crashes...

MAL-2024-7508 Malicious code in sap-addr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a86f1f5a5ebc610e32833675417c2fd45fd2d4e3cf39177e17a751d54c0599df The OpenSSF Package Analysis project identified 'sap-addr' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in sap-addr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a86f1f5a5ebc610e32833675417c2fd45fd2d4e3cf39177e17a751d54c0599df The OpenSSF Package Analysis project identified 'sap-addr' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2022-48762 arm64: extable: fix load_unaligned_zeropad() reg indices

In the Linux kernel, the following vulnerability has been resolved: arm64: extable: fix loadunalignedzeropad reg indices In exhandlerloadunalignedzeropad we erroneously extract the data and addr register indices from ex-type rather than ex-data. As ex-type will contain EXTYPELOADUNALIGNEDZEROPAD...

CVE-2024-38588

In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix possible use-after-free issue in ftracelocation KASAN reports a bug: BUG: KASAN: use-after-free in ftracelocation+0x90/0x120 Read of size 8 at addr ffff888141d40010 by task insmod/424 CPU: 8 PID: 424 Comm: insmod...