CVE-2022-48824 scsi: myrs: Fix crash in error case

In the Linux kernel, the following vulnerability has been resolved: scsi: myrs: Fix crash in error case In myrsdetect, cs-disableintr is NULL when privdata-hwinit fails with non-zero. In this case, myrscleanupcs will call a NULL ptr and crash the kernel. 1.105606 myrs 0000:00:03.0: Unknown...

A week in security (July 8 – July 14)

Last week on Malwarebytes Labs: "Nearly all" AT&T customers had phone records stolen in new data breach disclosure Fake Microsoft Teams for Mac delivers Atomic Stealer Dangerous monitoring tool mSpy suffers data breach, exposes customer details iPhone users in 98 countries warned about spyware by...

DEBIAN-CVE-2024-39503

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type Lion Ackermann reported that there is a race condition between namespace cleanup in ipset and the garbage collection of the list:set type. The...

Git for Windows < 2.45.1 Multiple Vulnerabilities

The version of Git for Windows installed on the remote host is prior to 2.45.1, and therefore is affected by multiple vulnerabilities: - Recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion that can be exploited to execute just-cloned code...

Malicious code in sap-case (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis df72ccd3a26b57183889e7490a0a49946b171fe6cf8aacdcb2df7f4480f840a5 The OpenSSF Package Analysis project identified 'sap-case' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7664 Malicious code in sap-case (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis df72ccd3a26b57183889e7490a0a49946b171fe6cf8aacdcb2df7f4480f840a5 The OpenSSF Package Analysis project identified 'sap-case' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

UBUNTU-CVE-2024-39489

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix memleak in seg6hmacinitalgo seg6hmacinitalgo returns without cleaning up the previous allocations if one fails, so it's going to leak all that memory and the crypto tfms. Update seg6hmacexit to only free the memory...

SUSE CVE-2024-37372

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases...

CVE-2024-5549

creationtimestamp| type| source ---|---|--- 2024-07-09 02:37:11+00:00| seen| https://t.me/cvedetector/221...

Exploit for Unrestricted Upload of File with Dangerous Type in Git

CVE-2024-32002: Exploiting Git RCE via git clone This repository contains a PoC for exploiting CVE-2024-32002, a vulnerability in Git that allows RCE during a git clone operation. By crafting repositories with submodules in a specific way, an attacker can exploit symlink handling on...

CVE-2024-37768

creationtimestamp| type| source ---|---|--- 2024-07-05 18:46:02+00:00| seen| Telegram/2868f05xZuQB3dwUhOpFZKP7D8vUeBjGOgoyMv4pohy...

New Support Website - July 15th 2024

New Support Website - July 15th 2024 Support.Citrix.com is migrating to a new platform. This is the main website for hosting public CTX knowledge articles and for customers to create and view their support cases. This new platform will launch on July 15th 2024 Callback and LiveChat are dependent ...

Astra Linux – Vulnerability in Firefox

In violation of the specification, cookie prefixes such as Secure were ignored if they were not capitalized correctly. According to the specification, these prefixes should be checked using a case-insensitive comparison. This could result in the browser not correctly implementing the behaviors...

CVE-2024-34027

A vulnerability was found in the Flash-Friendly File System F2FS in the Linux kernel, where the reservecompressblocks and releasecompressblocks functions were not adequately protected by the cprwsem lock. This locking deficiency could lead to race conditions, potentially causing data corruption o...

Malicious code in jewel-case (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2543 Malicious code in jewel-case (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-34027

CVE-2024-34027 corresponds to a Linux kernel/F2FS issue where the f2fs compress path ({reserve,release}_compress_blocks()) could race with checkpoint due to cp_rwsem lock issues, risking corruption of filesystem metadata (blkaddr in dnode, inode fields, and .total_valid_block_count) after SPO. Th...

CVE-2024-34027 f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock

In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to cover reserve,releasecompressblocks w/ cprwsem lock It needs to cover reserve,releasecompressblocks w/ cprwsem lock to avoid racing with checkpoint, otherwise, filesystem metadata including blkaddr in dnode...

CVE-2022-48728

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix AIP early init panic An early failure in hfi1ipoibsetuprn can lead to the following panic: BUG: unable to handle kernel NULL pointer dereference at 00000000000001b0 PGD 0 P4D 0 Oops: 0002 1 SMP NOPTI Workqueue: event...

DEBIAN-CVE-2022-48750

In the Linux kernel, the following vulnerability has been resolved: hwmon: nct6775 Fix crash in clearcaseopen Paweł Marciniak reports the following crash, observed when clearing the chassis intrusion alarm. BUG: kernel NULL pointer dereference, address: 0000000000000028 PGD 0 P4D 0 Oops: 0000 1...