OESA-2022-1661 golang security update

The Go Programming Language. Security Fixes: Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.CVE-2021-44717 encoding/pem in...

Improper Resource Shutdown or Release

Overview std/syscall is a Go standard library package std/syscall Affected versions of this package are vulnerable to Improper Resource Shutdown or Release. Go Vulnerability Report: When a Go program running on a Unix system is out of file descriptors and calls syscall.ForkExec including indirect...

GHSA-9WCX-326R-7J7W Denial of Service in Apache ActiveMQ

Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service file-descriptor exhaustion and broker crash or hang by sending many openwire failover:tcp:// connection requests...

Denial of Service in Apache ActiveMQ

Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service file-descriptor exhaustion and broker crash or hang by sending many openwire failover:tcp:// connection requests...

libtirpc: DoS vulnerability with lots of connections

A denial of service DoS vulnerability was found in libtirpc. This flaw allows a remote attacker to exhaust the file descriptors of a process that uses libtirpc due to mishandling idle TCP connections. This issue leads to a svcrun infinite loop without accepting new connections...

PT-2024-9248

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the drm/vmwgfx component of the Linux kernel, where a failing usercopy of the fence rep object leads to a stale entry in the file descriptor table. This allows...

CVE-2021-44717

There's a flaw in golang's syscall.ForkExec interface. An attacker who manages to first cause a file descriptor exhaustion for the process, then cause syscall.ForkExec to be called repeatedly, could compromise data integrity and/or confidentiality in a somewhat uncontrolled way in programs linked...

Amazon Linux AMI : golang (ALAS-2022-1583)

The version of golang installed on the remote host is prior to 1.16.15-1.37. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1583 advisory. 2024-01-03: CVE-2021-27919 was added to this advisory. An out of bounds read vulnerability was found in golang. When...

CLSA-2022-1651146021 Fix of CVE: CVE-2022-0617, CVE-2021-40490, CVE-2021-29154, CVE-2022-0435, CVE-2021-4154, CVE-2021-3753, CVE-2021-38160, CVE-2021-45485, CVE-2021-3752, CVE-2021-41864, CVE-2021-4083, CVE-2021-26930

udf: Restore ilenAlloc when inode expansion fails Jan Kara CVE-2022-0617 - udf: Fix NULL ptr deref when converting from inline format Jan Kara CVE-2022-0617 - Bluetooth: fix use-after-free error in locksocknested Wang ShaoBo CVE-2021-3752 - vtkdsetmode: extend console locking Linus Torvalds...

Rocky Linux 8 : polkit (RLSA-2022:1546)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:1546 advisory. - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from thi...

Oracle Linux 8 : polkit (ELSA-2022-1546)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-1546 advisory. 0.115-13.0.1.el85.2 - Increase timeout to avoid defunct processes Orabug: 26930744 0.115-13.el85.2 - necessary version bump due to build versioning - Resolves:...

Moderate: Red Hat Security Advisory: polkit security update

An update for polkit is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

polkit: file descriptor leak allows an unprivileged user to cause a crash

There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage duration is tied to the failing process being reaped and a new one being...

ALSA-2022:1546 Moderate: polkit security update

The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privileged processes to communicate with privileged ones. Security Fixes: polkit: file descriptor leak allows an unprivileged user to cause a crash...

RLSA-2022:1546 Moderate: polkit security update

The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privileged processes to communicate with privileged ones. Security Fixes: polkit: file descriptor leak allows an unprivileged user to cause a crash...

Moderate: polkit security update

The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privileged processes to communicate with privileged ones. Security Fixes: polkit: file descriptor leak allows an unprivileged user to cause a crash...

polkit security update

An update is available for polkit. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The polkit packages provide a component for controlling system-wide privileges...

EulerOS 2.0 SP8 : polkit (EulerOS-SA-2022-1580)

According to the versions of the polkit packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest...

Huawei EulerOS: Security Advisory for polkit (EulerOS-SA-2022-1580)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP10 : golang (EulerOS-SA-2022-1487)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2...