November Linux Patch Wednesday

November Linux Patch Wednesday. I was happy in October that the number of vulnerabilities was gradually decreasing to an acceptable level, and in November I got a peak again. A total of 803 vulnerabilities. Of these, 567 are in the Linux Kernel. Kind of crazy. 2 vulnerabilities in Chromium with...

The vulnerability of the Eclipse Mosquitto messaging broker, related to memory reclamation, allows a hacker to trigger a service failure.

The vulnerability of the Eclipse Mosquitto messaging broker is related to repeated memory release. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...

The vulnerability of the Eclipse Mosquitto messaging broker, related to buffer overflows in dynamic memory, allows an attacker to gain access to confidential information.

The vulnerability of the Eclipse Mosquitto messaging broker is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to confidential information...

Security Bulletin: Several Security Vulnerabilities were discovered in IBM Security Directory Suite

Summary Several Security Vulnerabilities in the IBM Security Directory Integrator and Eclipse Jetty were addressed in the IBM Security Directory Suite. Vulnerability Details CVEID:CVE-2022-32759 DESCRIPTION: IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0...

Security Bulletin: IBM Sterling B2B Integrator is affected by multiple vulnerabilities in Eclipse Jetty

Summary IBM Sterling B2B Integrator is affected by multiple vulnerabilities in Eclipse Jetty Vulnerability Details CVEID:CVE-2023-41900 DESCRIPTION: Eclipse Jetty could allow a remote authenticated attacker to bypass security restrictions, caused by improper authentication validation when using t...

The vulnerability of the Eclipse Glassfish application server relates to the redirection of URLs to an unreliable website, allowing attackers to redirect users to any given URL address.

The vulnerability of the Eclipse Glassfish application server is related to the redirection of URLs to an unreliable website. Exploiting this vulnerability allows a hacker to redirect users to any given URL address...

The vulnerability of the ConsumerPullTransferTokenValidationApiController component in the data-processing and information ecosystem software for Eclipse EDC allows a perpetrator to bypass token expiration checks.

The vulnerability of the ConsumerPullTransferTokenValidationApiController component in the data-processing and information ecosystem of Eclipse EDC is related to authentication procedures’ flaws. Exploiting this vulnerability could allow a malicious actor to bypass token expiration checks...

The vulnerability of the Eclipse Vert.x tool set, related to memory leaks, allows an attacker to disclose protected information or cause service failures.

The vulnerability of the Eclipse Vert.x framework is related to memory leaks. Exploiting this vulnerability can allow an attacker to disclose sensitive information or cause service failures...

ROS-20241112-07

Eclipse Mosquitto message broker vulnerability is related to a heap buffer overflow when executing a onsubscribe callback. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to sensitive information The Eclipse Mosquitto message broker vulnerability is relate...

[BSA-120] Security Update for mosquitto

Philippe Coval uploaded new packages for mosquitto which fixed the following security problems: CVE-2024-8376 In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNECT",...

CVE-2024-10917

In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is correct but may be truncated to include a smaller number of characters...

CVE-2024-10917

CVE-2024-10917 affects OpenJ9: in OpenJ9 up to version 0.47, GetStringUTFLength can wrap around, returning an incorrect value. From 0.48, the value is correct but may be truncated to include fewer characters. Remediation: upgrade to OpenJ9 0.48.0 or later.

CVE-2024-10917 Eclipse OpenJ9 might return an incorrect value in JNI function GetStringUTFLength

In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is correct but may be truncated to include a smaller number of characters...

CVE-2024-10917 Eclipse OpenJ9 might return an incorrect value in JNI function GetStringUTFLength

In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is correct but may be truncated to include a smaller number of characters...

CVE-2024-10917 Eclipse OpenJ9 might return an incorrect value in JNI function GetStringUTFLength

In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is correct but may be truncated to include a smaller number of characters...

Security Bulletin: Vulnerabilities Addressed in IBM Tivoli Network Manager IP Edition (ITNM) version 4.2 Fix Pack 20 (4.2.0.20)

Summary Multiple vulnerabilities were addressed in ITNM version 4.2 Fix Pack 20 4.2.0.20 Vulnerability Details CVEID:CVE-2024-23944 DESCRIPTION: Apache ZooKeeper could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw in persistent watchers handling. By...

Eclipse OpenJ9 输入验证错误漏洞

Eclipse OpenJ9 is a Java application engine from the Eclipse Foundation. The product is primarily used to run Java applications. An input validation error vulnerability exists in Eclipse OpenJ9 version 0.47 and earlier versions, which stems from the JNI function GetStringUTFLength that may return...

PT-2024-16639 · Eclipse +2 · Eclipse Openj9 +2

Name of the Vulnerable Software and Affected Versions: Eclipse OpenJ9 versions up to 0.47 Description: The JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From version 0.48, the value is correct but may be truncated to include a smaller number of characters...

Security Bulletin: IBM Sterling Control Center is vulnerable to IBM Java Buffer overflow in GC

Summary IBM Java: Buffer overflow in GC when using the -Xgc:concurrentScavenge option on IBM Z is affecting Sterling Control Center v6.2.1 and v6.3.1. Vulnerability Details CVEID:CVE-2024-3933 DESCRIPTION: Eclipse Openj9 could allow a local authenticated attacker to bypass security restrictions,...

Security Bulletin: IBM Sterling Control Center is vulnerable to IBM Semeru Runtime Quarterly CPU - Apr 2024 - Includes OpenJDK Apr 2024 CPU

Summary IBM Semeru Runtime Quarterly CPU - Apr 2024 is affecting Sterling Control Center v6.2.1 and v6.3.1. Vulnerability Details CVEID:CVE-2024-21085 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause low availability impacts...