SUSE-SU-2024:0279-1 Security update for slurm

This update for slurm fixes the following issues: Security fixes: - CVE-2023-41914: Prevent filesystem race conditions that could let an attacker take control of an arbitrary file, or remove entire directories' contents. bsc1216207 - CVE-2023-49933: Prevent message extension attacks that could...

CVE-2024-0675

Vulnerability of improper checking for unusual or exceptional conditions in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, the exploitation of which could allow an attacker with physical access to the ATM to escape kiosk mode, access the underlying Xwindow interface and execute arbitrary...

GHSA-8J3X-W35R-RW4R Quarkus Improper Handling of Insufficient Permissions or Privileges and Improper Handling of Exceptional Conditions vulnerability

A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed deserialized prior to the security constraints being evaluated and applied. This does not happen with configuration based security...

hw: amd: Cross-Process Information Leak

A flaw was found in hw, in “Zen 2” CPUs. This issue may allow an attacker to access sensitive information under specific microarchitectural circumstances...

hw: amd: Cross-Process Information Leak

A flaw was found in hw, in “Zen 2” CPUs. This issue may allow an attacker to access sensitive information under specific microarchitectural circumstances...

Moderate: Red Hat Security Advisory: rpm security update

An update for rpm is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

VPX running on KVM platforms with virtio NICs might report TX stall when operating in single PE mode

VPX running on KVM platforms with virtio NICs might report TX stall when operating in single PE mode. The following conditions must be met to hit this issue. 1 VPX hosted on KVM 2 Version: 13.1-45.x or later 3 2vCPU single PE 4 When the packet takes more than 4 sec to get transferred...

Information disclosure

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.5 is vulnerable to an insecure cryptographic algorithm and to information disclosure in stack trace under exceptional conditions. IBM X-Force ID: 270730...

CLSA-2024-1705496273 kernel: Fix of 13 CVEs

Bluetooth: L2CAP: Fix use-after-free in l2capsockreadycb CVE-2023-40283 - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet CVE-2023-6932 - smb: client: fix OOB in smbCalcSize CVE-2023-6606 - net/sched: schhfsc: Ensure inner classes have fsc curve CVE-2023-4623 - net/sched: clsfw:...

Design/Logic Flaw

An Improper Handling of Exceptional Conditions vulnerability in the broadband edge subscriber management daemon bbe-smgd of Juniper Networks Junos OS on MX Series allows an attacker directly connected to the vulnerable system who repeatedly flaps DHCP subscriber sessions to cause a slow memory...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-045)

The version of kernel installed on the remote host is prior to 5.10.205-195.804. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-045 advisory. A race condition leading to a use-after-free issue was found in the QXL driver in the Linux kernel...

The vulnerability of the HTTP2 protocol implementation (network/access/http2/hpacktable.cpp) in the cross-platform development framework for Qt software allows a perpetrator to cause service failures.

The vulnerability of the HTTP2 protocol implementation network/access/http2/hpacktable.cpp of the cross-platform development framework for Qt is related to a numerical overflow caused by changes to the typical expression order in conditional operators “Yoda conditions”. Exploiting this...

Duplicate Advisory: Improper Handling of Exceptional Conditions in Newtonsoft.Json

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5crp-9r3c-p9vr. This link is maintained to preserve external references. Original Description Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted...

CVE-2024-21907

Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an...

CVE-2024-21907

CVE-2024-21907 affects Newtonsoft.Json before 13.0.1. Crafted data passed to JsonConvert.DeserializeObject may trigger a StackOverflow, causing denial of service; exploitation may be possible remotely and without authentication depending on how the library is used. IBM and Microsoft advisories co...

GitLab 13.4 < 13.12.9 / 14.0 < 14.0.7 / 14.1 < 14.1.2 (CVE-2021-22253)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protected environments under specific conditions...

In some pools, borrowers can maliciously prevent liquidatePosition()

Lines of code Vulnerability details Vulnerability details in liquidatePosition At the end of the liquidation, the liquidation fee will be transferred to the liquidator. function liquidatePosition DataStruct.ClosePositionParams calldata params, address borrower external override nonReentrant...

Security Bulletin: IBM® Db2® is vulnerable to denial of service under extreme stress conditions. (CVE-2023-40692)

Summary IBM® Db2® is vulnerable to denial of service under extreme stress conditions. Vulnerability Details CVEID:CVE-2023-40692 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to denial of service under extreme stress conditions. CVSS Base score: 5.9 CV...

SUSE-SU-2023:4811-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2023-39197: Fixed a out-of-bounds read in nfconntrackdccppacket bsc1216976. - CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm...

Ubuntu: Security Advisory (USN-6549-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...