golang: archive/zip: Reader.Open panics on empty string

A vulnerability was found in archive/zip of the Go standard library. Applications written in Go where Reader.Open the API implementing io/fs.FS introduced in Go 1.16 can panic when parsing a crafted ZIP archive containing completely invalid names or an empty filename argument...

kernel: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes

A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write. This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation...

kernel: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes

A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write. This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation...

SUSE-SU-2022:1611-1 Security update for the Linux Kernel (Live Patch 30 for SLE 12 SP5)

This update for the Linux Kernel 4.12.14-122116 fixes one issue. The following security issue was fixed: - CVE-2022-1011: A use-after-free flaw was found in the FUSE filesystem in the way a user triggers write. This flaw allowed a local user to gain unauthorized access to data from the FUSE...

SUSE-SU-2022:1598-1 Security update for the Linux Kernel (Live Patch 29 for SLE 15)

This update for the Linux Kernel 4.12.14-15000015089 fixes several issues. The following security issues were fixed: - CVE-2021-39713: Fixed a race condition in the network scheduling subsystem which could lead to a use-after-free. bsc1197211 - CVE-2022-1011: A use-after-free flaw was found in th...

mozilla-filesystem bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

mozilla-filesystem bug fix and enhancement update

An update is available for mozilla-filesystem. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

SUSE-SU-2022:1593-1 Security update for the Linux Kernel (Live Patch 30 for SLE 15 SP1)

This update for the Linux Kernel 4.12.14-150100197111 fixes several issues. The following security issues were fixed: - CVE-2022-1011: A use-after-free flaw was found in the FUSE filesystem in the way a user triggers write. This flaw allowed a local user to gain unauthorized access to data from t...

Slackware Linux 15.0 kernel-generic Multiple Vulnerabilities (SSA:2022-129-01)

The version of kernel-generic installed on the remote host is prior to 5.15.38 / 5.15.38smp. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-129-01 advisory. - Non-transparent sharing of branch predictor selectors between contexts in some IntelR Processors may...

NewStart CGSL CORE 5.04 / MAIN 5.04 : docker-ce Multiple Vulnerabilities (NS-SA-2022-0007)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has docker-ce packages installed that are affected by multiple vulnerabilities: - runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because...

Siemens Teamcenter

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Teamcenter Vulnerabilities: Stack-based Buffer Overflow, Improper Restriction of XML External Entity Reference 2. UPDATE INFORMATION This updated advisory is a follow-up to the...

Huawei EulerOS: Security Advisory for util-linux (EulerOS-SA-2022-1654)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for golang-github-google-slothfs (FEDORA-2022-08ae2dd481)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for golang-github-containerd-continuity (FEDORA-2022-08ae2dd481)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2021-4155

A data leak flaw was found in the way XFSIOCALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them. Mitigation This issue can be mitigated by ensuring...

[SECURITY] Fedora 36 Update: golang-github-intel-goresctrl-0.2.0-4.fc36

Golang library for managing resctrl filesystem...

[SECURITY] Fedora 36 Update: golang-github-google-slothfs-0-0.10.20200727git59c1163.fc36

SlothFS is a FUSE filesystem that provides light-weight, lazily downloaded, read-only checkouts of manifest-based Git projects. It is intended for use wi th Android...

[SECURITY] Fedora 36 Update: golang-github-containerd-continuity-0.2.2-2.fc36

A transport-agnostic, filesystem metadata manifest system...

Design/Logic Flaw

A vulnerability in which attackers could forge HTTP requests to manipulate the charm data directory to access or delete anything on the server. This has been patched and is available in release v0.12.1. We recommend that all users running self-hosted charm instances update immediately. This...

CVE-2022-29180 Charm vulnerable to server-side request forgery (SSRF)

A vulnerability in which attackers could forge HTTP requests to manipulate the charm data directory to access or delete anything on the server. This has been patched and is available in release v0.12.1. We recommend that all users running self-hosted charm instances update immediately. This...