CVE-2024-26673

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: sanitize layer 3 and 4 protocol number in custom expectations - Disallow families other than NFPROTOIPV4,IPV6,INET. - Disallow layer 4 protocol with no ports, since destination port is a mandatory attribute for...

CVE-2024-26673

CVE-2024-26673 affects the Linux kernel netfilter nft_ct, where custom expectations could mishandle layer 3/4 protocol numbers. The issue arises from insufficient validation, allowing unexpected protocol families beyond NFPROTO_IPV4/IPv6/INET and permitting layer-4 protocols without ports, since ...

CVE-2024-26673 netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: sanitize layer 3 and 4 protocol number in custom expectations - Disallow families other than NFPROTOIPV4,IPV6,INET. - Disallow layer 4 protocol with no ports, since destination port is a mandatory attribute for...

destination-golf.de Cross Site Scripting vulnerability OBB-3888491

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

OESA-2024-1319 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage function, allowing a user to trigger a heap buffer overflow via a local network. Successful...

OESA-2024-1318 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage function, allowing a user to trigger a heap buffer overflow via a local network. Successful...

OESA-2024-1317 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage function, allowing a user to trigger a heap buffer overflow via a local network. Successful...

OESA-2024-1314 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage function, allowing a user to trigger a heap buffer overflow via a local network. Successful...

CLSA-2024-1711026398 kernel: Fix of 7 CVEs

netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one CVE-2023-39197 - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier CVE-2023-52449 - media: pvrusb2: fix use after free on context disconnection CVE-2023-52445 - net: prevent mss overflow in skbsegment...

SUSE CVE-2023-52612

In the Linux kernel, the following vulnerability has been resolved: crypto: scomp - fix req-dst buffer overflow The req-dst buffer size should be checked before copying from the scompscratch-dst to avoid req-dst buffer overflow problem...

DEBIAN-CVE-2023-52612

In the Linux kernel, the following vulnerability has been resolved: crypto: scomp - fix req-dst buffer overflow The req-dst buffer size should be checked before copying from the scompscratch-dst to avoid req-dst buffer overflow problem...

UBUNTU-CVE-2023-52612

In the Linux kernel, the following vulnerability has been resolved: crypto: scomp - fix req-dst buffer overflow The req-dst buffer size should be checked before copying from the scompscratch-dst to avoid req-dst buffer overflow problem...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a buffer overflow vulnerability in scomp-fix-req-dst...

CVE-2023-7060

Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination address...

CVE-2024-20319

A vulnerability in the UDP forwarding code of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to bypass configured management plane protection policies and access the Simple Network Management Plane SNMP server of an affected device. This vulnerability is due to incorrect...

CVE-2024-25994

An unauthenticated remote attacker can upload a arbitrary script file due to improper input validation. The upload destination is fixed and is write only...

CVE-2024-25994

An unauthenticated remote attacker can upload a arbitrary script file due to improper input validation. The upload destination is fixed and is write only...

Input validation

An unauthenticated remote attacker can upload a arbitrary script file due to improper input validation. The upload destination is fixed and is write only...

kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system...

PT-2024-21270 · Phoenix Contact · Charx Sec-3100 Charxupdateagent

Name of the Vulnerable Software and Affected Versions: Phoenix Contact CHARX SEC-3100 CharxUpdateAgent affected versions not specified Description: An unauthenticated remote attacker can upload an arbitrary script file due to improper input validation. The upload destination is fixed and is write...