kernel: scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE

A flaw was found in the lpfc module in the Linux kernel. A missing release of allocated memory when an error occurs will cause a memory leak, potentially impacting system performance and resulting in a denial of service...

RHEL 9 : lua (RHSA-2022:7329)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7329 advisory. The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently us...

lua: heap buffer overflow in luaG_errormsg() in ldebug.c due to uncontrolled recursion in error handling

A vulnerability was found in Lua. During error handling, the luaGerrormsg component uses slots from EXTRASTACK. Some errors can recur such as a string overflow while creating an error message in 'luaGrunerror', or a C-stack overflow before calling the message handler, causing a crash that leads t...

lua security update

An update is available for lua. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The lua packages provide support for Lua, a powerful light-weight programming...

OPENSUSE-SU-2022:10186-1 Security update for privoxy

This update for privoxy fixes the following issues: privoxy was updated to 3.0.33 boo1193584: CVE-2021-44543: Encode the template name to prevent XSS cross-side scripting when Privoxy is configured to servce the user-manual itself CVE-2021-44540: Free memory of compiled pattern spec before bailin...

CURL-CVE-2022-42915 HTTP proxy double free

If curl is told to use an HTTP proxy for a transfer with a non-HTTPS URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of protocol through. An HTTP proxy might refuse this request HTTP proxies often only allow outgoing...

curl 资源管理错误漏洞

curl is a tool for transferring data from or to a server. A security vulnerability exists in curl, which stems from a problem in error/cleanup handling that could result in a double release if a transfer with a non-HTTPS URL is performed using an HTTP proxy...

mysql: Server: Error Handling unspecified vulnerability (CPU Oct 2021)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Error Handling. Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successfu...

kernel: iavf: Fix adminq error handling

In the Linux kernel, the following vulnerability has been resolved: iavf: Fix adminq error handling iavfallocasqbufs/iavfallocarqbufs allocates with dmaalloccoherent memory for VF mailbox. Free DMA regions for both ASQ and ARQ in case error happens during configuration of ASQ/ARQ registers. Witho...

kernel: iavf: Fix NULL pointer dereference in iavf_get_link_ksettings

A flaw was found in the iavf module in the Linux kernel. A NULL pointer dereference can be triggered due to improper error management, resulting in a denial of service...

Cisco Email Security Appliance DNS Verification DoS (cisco-sa-esa-dos-MxZvGtgU)

According to its self-reported version, Cisco Email Security Appliance is affected by a vulnerability in the DNS-based Authentication of Named Entities DANE email verification component that allows an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected devic...

CVE-2022-33748

lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a result two cooperating guests granting each other transitive grants can cause locks to be...

Design/Logic Flaw

lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a result two cooperating guests granting each other transitive grants can cause locks to be...

Cisco IOS XE Software IPv6 VPN over MPLS DoS (cisco-sa-iosxe-6vpe-dos-tJBtf5Zv)

A vulnerability in the implementation of IPv6 VPN over MPLS 6VPE with Zone-Based Firewall ZBFW of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service condition on an affected device. This vulnerability is due to improper error handling of an IPv6...

Microsoft Windows TCP/IP component 资源管理错误漏洞

Microsoft Windows TCP/IP component is a component of Microsoft Corporation USA that provides TCP/IP configuration functionality for Windows.A denial of service vulnerability exists in Microsoft Windows TCP/IP, which stems from a failure to properly handle incoming error messages. An attacker coul...

CVE-2022-33748

lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a result two cooperating guests granting each other transitive grants can cause locks to be...

LIEF Denial of Service Vulnerability

LIEF is a cross-platform library from the personal developer Romain Thomas. Used for parsing, modifying and abstracting Elf, Pe and MachO formats, a denial of service vulnerability exists in LIEF v0.12.1, which stems from a failure to properly handle incoming error messages in the initandparse...

GSD-2022-1006603 mm/slub: fix to return errno if kmalloc() fails

mm/slub: fix to return errno if kmalloc fails This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.215 by commit...

PT-2022-34867 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.295 Description: The issue is related to a potential security vulnerability in the Linux Kernel. It has been fixed in version v4.14.295. The problem occurs when kmalloc fails, and an error is not properly...

PT-2022-34859 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.215 Description: The issue is related to a potential security vulnerability in the Linux Kernel. It involves a fix to return an error number if the kmalloc function fails. The actual impact and attack...