OPENSUSE-SU-2024:14135-1 python310-bugzilla-3.2.0-2.3 on GA media

These are all security issues fixed in the python310-bugzilla-3.2.0-2.3 package on the GA media of openSUSE Tumbleweed...

SUSE SLES15: freeradius-server / freeradius-server-devel / etc (SUSE-SU-2024:2367-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2367-1 advisory. - CVE-2024-3596: Fixed chosen-prefix collision attack against MD5 bsc1223414. Tenable has extracted the preceding description block directly...

OPENSUSE-SU-2024:10058-1 python-bugzilla-1.2.2-1.1 on GA media

These are all security issues fixed in the python-bugzilla-1.2.2-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10664-1 bugzilla-5.0.6-4.2 on GA media

These are all security issues fixed in the bugzilla-5.0.6-4.2 package on the GA media of openSUSE Tumbleweed...

CVE-2024-5742

A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privilege...

SUSE SLES12: libpoppler-cpp0 / libpoppler-devel / libpoppler-glib-devel / etc (SUSE-SU-2024:1899-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1899-1 advisory. - CVE-2024-4141: Fixed out-of-bounds array write bsc1223375. Tenable has extracted the preceding description block directly from the SUSE...

CVE-2024-5564

A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in NetworkManager, triggered by sending a malformed IPv6 router advertisement packet. This issue occurred as libndp was not correctly validating the route length information...

openSUSE 15 Security Update : qt6-networkauth (openSUSE-SU-2024:0138-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2024:0138-1 advisory. - CVE-2024-36048: Fixed data race and poor seeding in generateRandomString boo1224782. Tenable has extracted the preceding description block directly fro...

CVE-2021-47490 drm/ttm: fix memleak in ttm_transfered_destroy

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix memleak in ttmtransfereddestroy We need to cleanup the fences for ghost objects as well. Bug: https://bugzilla.kernel.org/showbug.cgi?id=214029 Bug: https://bugzilla.kernel.org/showbug.cgi?id=214447...

CVE-2021-47490 drm/ttm: fix memleak in ttm_transfered_destroy

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix memleak in ttmtransfereddestroy We need to cleanup the fences for ghost objects as well. Bug: https://bugzilla.kernel.org/showbug.cgi?id=214029 Bug: https://bugzilla.kernel.org/showbug.cgi?id=214447...

CVE-2021-47490

CVE-2021-47490 affects the Linux kernel DRM memory management (drm/ttm). The issue is a memleak during ttm_transfered_destroy, and the fix includes cleanup of fences for ghost objects. The available connected advisories/policy notes confirm the vulnerability is fixed by kernel patches; no exploit...

CVE-2021-47388

In the Linux kernel, the following vulnerability has been resolved: mac80211: fix use-after-free in CCMP/GCMP RX When PN checking is done in mac80211, for fragmentation we need to copy the PN to the RX struct so we can later use it to do a comparison, since commit bf30ca922a0c "mac80211: check...

CVE-2024-35846

In the Linux kernel, the following vulnerability has been resolved: mm: zswap: fix shrinker NULL crash with cgroupdisable=memory Christian reports a NULL deref in zswap that he bisected down to the zswap shrinker. The issue also cropped up in the bug trackers of libguestfs 1 and the Red Hat...

CVE-2024-35846

In the Linux kernel, the following vulnerability has been resolved: mm: zswap: fix shrinker NULL crash with cgroupdisable=memory Christian reports a NULL deref in zswap that he bisected down to the zswap shrinker. The issue also cropped up in the bug trackers of libguestfs 1 and the Red Hat...

CVE-2024-35846 mm: zswap: fix shrinker NULL crash with cgroup_disable=memory

In the Linux kernel, the following vulnerability has been resolved: mm: zswap: fix shrinker NULL crash with cgroupdisable=memory Christian reports a NULL deref in zswap that he bisected down to the zswap shrinker. The issue also cropped up in the bug trackers of libguestfs 1 and the Red Hat...

CVE-2024-35846

CVE-2024-35846 affects the Linux kernel’s zswap shrinker under memcg-disabled (boot flag cgroup_disable=memory). A NULL memcg (sc->memcg == NULL) could cause a NULL dereference in memcg_page_state(), leading to a crash. The issue has been fixed in the kernel (as described in the connected docu...

CVE-2024-35846

In the Linux kernel, the following vulnerability has been resolved: mm: zswap: fix shrinker NULL crash with cgroupdisable=memory Christian reports a NULL deref in zswap that he bisected down to the zswap shrinker. The issue also cropped up in the bug trackers of libguestfs 1 and the Red Hat...

CVE-2024-35846 mm: zswap: fix shrinker NULL crash with cgroup_disable=memory

In the Linux kernel, the following vulnerability has been resolved: mm: zswap: fix shrinker NULL crash with cgroupdisable=memory Christian reports a NULL deref in zswap that he bisected down to the zswap shrinker. The issue also cropped up in the bug trackers of libguestfs 1 and the Red Hat...

CVE-2024-21823

Hardware logic with insecure de-synchronization in IntelR DSA and IntelR IAA for some IntelR 4th or 5th generation XeonR processors may allow an authorized user to potentially enable escalation of privilege local access...

PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

Impact If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true which is the default value, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. Patches The patch removes the use of eval:...