Security update for 389-ds

This update for 389-ds fixes the following issues: Persist extracted key path for ldapsslclientinit over repeat invocations bsc1230852 Re-enable use of .dsrc basedn for dsidm commands bsc1231462 Update to version 2.2.10git18.20ce9289: RFE: Use previously extracted key path Update dsidm to...

What is known about the Spoofing – Windows MSHTML Platform (CVE-2024-43573) vulnerability from the October Microsoft Patch Tuesday?

What is known about the Spoofing - Windows MSHTML Platform CVE-2024-43573 vulnerability from the October Microsoft Patch Tuesday? In fact, just that it is being exploited in the wild. There are no write-ups or public exploits yet. The Acknowledgements section in the Microsoft bulletin is empty. I...

UBUNTU-CVE-2024-46954

An issue was discovered in decodeutf8 in base/gputf8.c in Artifex Ghostscript before 10.04.0. Overlong UTF-8 encoding leads to possible ../ directory traversal...

CISA Releases Three Industrial Control Systems Advisories

CISA released three Industrial Control Systems ICS advisories on October 29, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-303-01 Siemens InterMesh Subscriber Devices ICSA-24-303-02 Solar-Log Base 15...

Solar-Log Base 15

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 5.1 ATTENTION : Exploitable remotely/low attack complexity/public exploits are available Vendor : Solar-Log Equipment : Base 15 Vulnerability : Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' 2. RISK EVALUATION Successful...

Linux kernel s390 Memory Management Heap Buffer Overflow DoS

The vulnerability of the functions crsttablefree and basecrstfree in the arch/s390/mm/pgalloc.c file, belonging to the memory management subsystem of the Linux operating system on the s390 platform, is related to the assignment of a null pointer. Exploiting this vulnerability could allow an...

canonicalwebteam-flask-base (>=0.3.3, <=0.9.3), flexget (>=2.21.21, <=3.1.104) +4 more potentially affected by CVE-2024-49766 via werkzeug (0.15.6)

werkzeug PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - canonicalwebteam-flask-base =0.3.3, =2.21.21, =0.1.0a27, =0.1.0, =0.15.0, =0.2.0, =0.2.1 Source cves: CVE-2024-49766 Source advisory:...

netify (>=0.1.1, <=0.2.0), odooku-odoo-account-invoicing (>=11.0.0, <=11.0.6) +36 more potentially affected by CVE-2024-49766 via werkzeug (0.11.11)

werkzeug PYPI version 0.11.11 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - netify =0.1.1, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0,...

anitya (1.8.1), datarobot-drum (>=1.10.0.dev2, <=1.10.11) +5 more potentially affected by CVE-2024-49766 via werkzeug (2.3.4)

werkzeug PYPI version 2.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - anitya 1.8.1 - datarobot-drum =1.10.0.dev2, =0.0.13, =3.2.4, =3.9.0rc4, =4.1.3 Source cves: CVE-2024-49766 Source advisory: OSV:GHSA-F9VJ-2WH5-F...

skopeo security update

An update is available for skopeo. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The skopeo command lets you inspect images from container image registries, ge...

openssl security update

An update is available for openssl. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transpo...

Security Bulletin: IBM Datapower Operations Dashboard could allow remote attacker to execute arbitrary commands on the system CVE-2017-16100

Summary dns-sync is used by the IBM Datapower Operations Dashboard implementation of networking operations Vulnerability Details CVEID:CVE-2017-16100 DESCRIPTION: Node.js dns-sync module could allow a remote attacker to execute arbitrary commands on the system, caused by the improper validation o...

Security Bulletin: IBM Sterling Connect:Direct Web Services is uses xmltooling-1.4.4.jar, which contains a vulnerability

Summary IBM Sterling Connect:Direct Web Services uses Shibboleth Identity Provider, which could allow a remote attacker to bypass security restrictions. It's caused by an error in the PKIX trust component. Vulnerability Details CVEID:CVE-2015-1796 DESCRIPTION: Shibboleth Identity Provider could...

Security Bulletin: Maximo Application Suite - IBM WebSphere Application Server Liberty is vulnerable to CVE-2023-50314 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses WebSphere Application Server Liberty which is vulnerable to CVE-2023-50314. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2023-50314 DESCRIPTION: IBM WebSphere Application...

Oracle E-Business Suite User Interface Unauthorized Access

The vulnerability of the User Interface component of the Oracle Installed Base information storage center in the Oracle E-Business Suite related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...

SUSE CVE-2024-46953

An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow when parsing the filename format string for the output filename results in path truncation, and possible path traversal and code execution...

Unbreakable Enterprise kernel security update

5.15.0-301.163.5.2 - mm: avoid leaving partial pfn mappings around in error case Linus Torvalds Orabug: 37174198 CVE-2024-47674 - Revert 'Documentation/admin-guide/acpi: Move information out of shell script comments' Dave Kleikamp Orabug: 37144820 - Revert 'irqchip/gic-v3: Move partitioncreatedes...

CVE-2024-27766

Disputed A flaw was found in MariaDB. This flaw allows a remote attacker to use a specially crafted payload to execute arbitrary commands in certain configurations. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +79 more potentially affected by CVE-2024-38820 via org.springframework:spring-web (4.3.0.release)

org.springframework:spring-web MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 - ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay...

Linux kernel Parallel Port Buffer Overflow DoS

The vulnerability of the dohardwarebaseaddr function in the drivers/parport/procfs.c file of the Linux parallel port driver relates to access to memory beyond the allocated buffer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibilit...