SUSE CVE-2024-7883

When using Arm Cortex-M Security Extensions CMSE, Secure stack contents can be leaked to Non-secure state via floating-point registers when a Secure to Non-secure function call is made that returns a floating-point value and when this is the first use of floating-point since entering Secure state...

PT-2024-34885 · Twig +3 · Twig +3

Name of the Vulnerable Software and Affected Versions: Twig versions prior to 3.11.2 Twig versions prior to 3.14.1 Description: In a sandbox, an attacker can call toString on an object even if the toString method is not allowed by the security policy when the object is part of an array or an...

DEBIAN-CVE-2024-50093

In the Linux kernel, the following vulnerability has been resolved: thermal: intel: int340x: processor: Fix warning during module unload The processorthermal driver uses pcimdeviceenable to enable a PCI device, which means the device will be automatically disabled on driver detach. Thus there is ...

CVE-2024-50093 thermal: intel: int340x: processor: Fix warning during module unload

In the Linux kernel, the following vulnerability has been resolved: thermal: intel: int340x: processor: Fix warning during module unload The processorthermal driver uses pcimdeviceenable to enable a PCI device, which means the device will be automatically disabled on driver detach. Thus there is ...

CVE-2024-50093

In the Linux kernel, the following vulnerability has been resolved: thermal: intel: int340x: processor: Fix warning during module unload The processorthermal driver uses pcimdeviceenable to enable a PCI device, which means the device will be automatically disabled on driver detach. Thus there is ...

CVE-2024-38419

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node...

CVE-2024-38419 Use After Free in Automotive GPU

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node...

CVE-2024-38419

CVE-2024-38419 corresponds to memory corruption when invoking IOCTL calls from user-space for the HGSL memory node in Qualcomm chipsets. The issue affects a memory node in HGSL, with a local attack vector and low privileges required; exploitation status is not detailed in the provided documents. ...

CVE-2024-38419 Use After Free in Automotive GPU

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node...

CVE-2024-38406

CVE-2024-38406 affects Qualcomm chipsets and is described as memory corruption when handling IOCTL calls in the JPEG Encoder driver. The NVD entry lists local access with high impact to confidentiality, integrity, and availability, with exploitation status not provided. Other connected records re...

CVE-2024-38406 Time-of-check Time-of-use (TOCTOU) Race Condition in Camera

Memory corruption while handling IOCTL calls in JPEG Encoder driver...

CVE-2024-38406 Time-of-check Time-of-use (TOCTOU) Race Condition in Camera

Memory corruption while handling IOCTL calls in JPEG Encoder driver...

CVE-2024-33033 Use After Free in ComputerVision

Memory corruption while processing IOCTL calls to unmap the buffers...

CVE-2024-33033 Use After Free in ComputerVision

Memory corruption while processing IOCTL calls to unmap the buffers...

A week in security (October 28 – November 3)

Last week on Malwarebytes Labs: 1,000+ web shops infected by "Phish ‘n Ships" criminals who create fake product listings for in-demand products Android malware FakeCall intercepts your calls to the bank Patch now! New Chrome update for two critical vulnerabilities Update your iPhone, Mac, Watch:...

New FakeCall Malware Variant Hijacks Android Devices for Fraudulent Banking Calls

Cybersecurity researchers have discovered a new version of a well-known Android malware family dubbed FakeCall that employs voice phishing aka vishing techniques to trick users into parting with their personal information. "FakeCall is an extremely sophisticated Vishing attack that leverages...

Command Injection

Overview deepspeed is a DeepSpeed library Affected versions of this package are vulnerable to Command Injection when multiple instances where subprocess.run and subprocess.checkoutput, are called with unsanitized input and shell=True. An attacker would need to supply specially crafted input to...

PostgreSQL Memory disclosure in aggregate function calls (CVE-2023-5868)

A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes,...

UBUNTU-CVE-2024-7883

When using Arm Cortex-M Security Extensions CMSE, Secure stack contents can be leaked to Non-secure state via floating-point registers when a Secure to Non-secure function call is made that returns a floating-point value and when this is the first use of floating-point since entering Secure state...

Android malware FakeCall intercepts your calls to the bank

An Android banking Trojan called FakeCall is capable of hijacking the phone calls you make to your bank. Instead of reaching your bank, your call will be redirected to the cybercriminals. The Trojan accomplishes this by installing itself as the default call handler on the infected device. The...