GSD-2023-1002392 IB/hfi1: Restore allocated resources on failed copyout

IB/hfi1: Restore allocated resources on failed copyout This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.168 by commit...

GSD-2023-1002389 ice: Do not use WQ_MEM_RECLAIM flag for workqueue

ice: Do not use WQMEMRECLAIM flag for workqueue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.168 by commit...

GSD-2023-1002382 s390/decompressor: specify __decompress() buf len to avoid overflow

s390/decompressor: specify decompress buf len to avoid overflow This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.169 by commit...

GSD-2023-1002377 nilfs2: fix underflow in second superblock position calculations

nilfs2: fix underflow in second superblock position calculations This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.169 by commit...

GSD-2023-1002373 net/sched: tcindex: search key must be 16 bits

net/sched: tcindex: search key must be 16 bits This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.169 by commit...

GSD-2023-1002370 IB/hfi1: Restore allocated resources on failed copyout

IB/hfi1: Restore allocated resources on failed copyout This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.94 by commit...

GSD-2023-1002355 net: sched: sch: Bounds check priority

net: sched: sch: Bounds check priority This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.95 by commit...

GSD-2023-1002336 of: Make OF framebuffer device names unique

of: Make OF framebuffer device names unique This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.12 by commit...

GSD-2023-1002323 bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself

bpf, sockmap: Don't let sockmapclose,destroy,unhash call itself This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.13 by commit...

GSD-2023-1002322 vdpa: ifcvf: Do proper cleanup if IFCVF init fails

vdpa: ifcvf: Do proper cleanup if IFCVF init fails This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.13 by commit...

GSD-2023-1002321 net: ethernet: mtk_eth_soc: Avoid truncating allocation

net: ethernet: mtkethsoc: Avoid truncating allocation This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.13 by commit...

GSD-2023-1002316 of: reserved_mem: Have kmemleak ignore dynamically allocated reserved mem

of: reservedmem: Have kmemleak ignore dynamically allocated reserved mem This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.13 by commit...

GSD-2023-1002315 kasan: fix Oops due to missing calls to kasan_arch_is_ready()

kasan: fix Oops due to missing calls to kasanarchisready This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.13 by commit...

GSD-2023-1002313 fbdev: Fix invalid page access after closing deferred I/O devices

fbdev: Fix invalid page access after closing deferred I/O devices This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.13 by commit...

CVE-2023-25169 Yearly Review Plugin leaking anonymised users data in discourse-yearly-review

discourse-yearly-review is a discourse plugin which publishes an automated Year in Review topic. In affected versions a user present in a yearly review topic that is then anonymised will still have some data linked to its original account. This issue has been patched in commit b3ab33bbf7 which is...

Attackers Flood NPM Repository with Over 15,000 Spam Packages Containing Phishing Links

In what's a continuing assault on the open source ecosystem, over 15,000 spam packages have flooded the npm repository in an attempt to distribute phishing links. "The packages were created using automated processes, with project descriptions and auto-generated names that closely resembled one...

Attackers Flood NPM Repository with Over 15,000 Spam Packages Containing Phishing Links

In what's a continuing assault on the open source ecosystem, over 15,000 spam packages have flooded the npm repository in an attempt to distribute phishing links. "The packages were created using automated processes, with project descriptions and auto-generated names that closely resembled one...

Liima 安全漏洞

Liima is a Liima open source application. Allows you to manage the configuration of Java EE applications in an unlimited number of different environments in various versions, including automated deployment of these applications. A security vulnerability exists in versions prior to Liima 1.17.28...

Regular Pen Testing Is Key to Resolving Conflict Between SecOps and DevOps

In an ideal world, security and development teams would be working together in perfect harmony. But we live in a world of competing priorities, where DevOps and security departments often butt heads with each other. Agility and security are often at odds with each other— if a new feature is...

CVE-2023-22743

Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL and putting into a subdirectory of a specific name living next to the Git for Windows installer, Windows can be tricked into side-loading said DLL. This...