CVE-2024-35195

An incorrect control flow implementation vulnerability was found in Requests. If the first request in a session is made with verify=False, all subsequent requests to the same host will continue to ignore cert verification...

CVE-2023-52691

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix a double-free in sidpminit When the allocation of adev-pm.dpm.dynstate.vddcdependencyondispclk.entries fails, amdgpufreeextendedpowertable is called to free some fields of adev. However, when the control flow...

CVE-2023-52691 drm/amd/pm: fix a double-free in si_dpm_init

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix a double-free in sidpminit When the allocation of adev-pm.dpm.dynstate.vddcdependencyondispclk.entries fails, amdgpufreeextendedpowertable is called to free some fields of adev. However, when the control flow...

CVE-2023-52691

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix a double-free in sidpminit When the allocation of adev-pm.dpm.dynstate.vddcdependencyondispclk.entries fails, amdgpufreeextendedpowertable is called to free some fields of adev. However, when the control flow...

CVE-2021-33157

Insufficient control flow management in some IntelR Ethernet Adapters and IntelR Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially enable escalation of privilege via local access...

[SECURITY] Fedora 39 Update: R-4.3.3-2.fc39

This is a metapackage that provides both core R userspace and all R development components. R is a language and environment for statistical computing and graphics. R is similar to the award-winning S system, which was developed at Bell Laboratories by John Chambers et al. It provides a wide varie...

Fedora 40 : xen (2024-3a36322c4b)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-3a36322c4b advisory. update to xen-4.18.1 rebase xen.gcc12.fixes.patch remove patches now included or superceded upstream ---- x86: Register File Data Sampling XSA-452,...

Exploiting the Conditional Branch Predictor

AMD ID: AMD-SB-7015 Potential Impact: N/A Severity: N/A Summary Researchers from the University of California San Diego have shared with AMD a paper titled “Pathfinder: High-Resolution Control-Flow Attacks Exploiting the Conditional Branch Predictor” that explores methods for forcing a branch...

Stable Channel Update for Desktop

The Stable channel has been updated to 124.0.6367.78/.79 for Windows and Mac and 124.0.6367.78 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. The Extended Stable channel has been updated to 124.0.6367.78/.79 for Windows and M...

OESA-2024-1415 varnish security update

This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x,...

SUSE SLED15: xen / xen-devel / xen-doc-html / xen-libs / xen-libs-32bit / etc (SUSE-SU-2024:1102-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1102-1 advisory. - CVE-2023-28746: Register File Data Sampling bsc1221332 - CVE-2024-2193: Fixed GhostRace, a...

varnish: HTTP/2 Broken Window Attack may result in denial of service

A flaw was found in the Varnish cache server, with HTTP/2 support enabled, that may allow a Denial of Service type of attack. A malicious actor can cause the server to run out of credits during the HTTP/2 connection control flow. As a consequence, the server will stop to properly process the acti...

AZL-39728 CVE-2024-31852 affecting package lldb for versions less than 18.1.2-2

LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we...

AZL-39713 CVE-2024-31852 affecting package lld for versions less than 18.1.2-2

LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we...

AZL-39791 CVE-2024-31852 affecting package compiler-rt for versions less than 18.1.2-2

LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we...

CVE-2024-31852

LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we...

AZL-49774 CVE-2024-31852 affecting package libcxx for versions less than 18.1.2-3

LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we...

AZL-39776 CVE-2024-31852 affecting package clang for versions less than 18.1.2-2

LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we...

DEBIAN-CVE-2024-31852

LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we...

AZL-39785 CVE-2024-31852 affecting package rust for versions less than 1.75.0-9

LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we...