CLSA-2022-1669242003 Fix CVE(s): CVE-2022-45063

SECURITY UPDATE: possible RCE when using OSC 50 sequence - debian/patches/CVE-2022-45063.patch: Improve error recovery when setting a bitmap font for the VT100 window, e.g., in case OSC 50 failed, restoring the most recent valid font so that a subsequent OSC 50 reports this correctly. -...

io.quarkus:quarkus-amazon-lambda-http-deployment (1.9.1.final), io.quarkus:quarkus-azure-functions-http-deployment (1.9.1.final) +34 more potentially affected by CVE-2022-4116 via io.quarkus:quarkus-vertx-http-deployment (1.9.1.final)

io.quarkus:quarkus-vertx-http-deployment MAVEN version 1.9.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http-deployment and may be impacted: - io.quarkus:quarkus-amazon-lambda-http-deployment 1.9.1.final -...

io.quarkus:quarkus-amazon-lambda-http-deployment (1.0.1.final), io.quarkus:quarkus-azure-functions-http-deployment (1.0.1.final) +27 more potentially affected by CVE-2022-4116 via io.quarkus:quarkus-vertx-http-deployment (1.0.1.final)

io.quarkus:quarkus-vertx-http-deployment MAVEN version 1.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http-deployment and may be impacted: - io.quarkus:quarkus-amazon-lambda-http-deployment 1.0.1.final -...

io.quarkus:quarkus-amazon-lambda-http-deployment (1.10.1.final), io.quarkus:quarkus-azure-functions-http-deployment (1.10.1.final) +34 more potentially affected by CVE-2022-4116 via io.quarkus:quarkus-vertx-http-deployment (1.10.1.final)

io.quarkus:quarkus-vertx-http-deployment MAVEN version 1.10.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http-deployment and may be impacted: - io.quarkus:quarkus-amazon-lambda-http-deployment 1.10.1.final -...

io.quarkus:quarkus-amazon-lambda-http-deployment (1.3.0.alpha2), io.quarkus:quarkus-azure-functions-http-deployment (1.3.0.alpha2) +30 more potentially affected by CVE-2022-4116 via io.quarkus:quarkus-vertx-http-deployment (1.3.0.alpha2)

io.quarkus:quarkus-vertx-http-deployment MAVEN version 1.3.0.alpha2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http-deployment and may be impacted: - io.quarkus:quarkus-amazon-lambda-http-deployment 1.3.0.alpha2 -...

io.quarkus:quarkus-amazon-lambda-http-deployment (1.11.5.final), io.quarkus:quarkus-azure-functions-http-deployment (1.11.5.final) +51 more potentially affected by CVE-2022-4116 via io.quarkus:quarkus-vertx-http-deployment (1.11.5.final)

io.quarkus:quarkus-vertx-http-deployment MAVEN version 1.11.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http-deployment and may be impacted: - io.quarkus:quarkus-amazon-lambda-http-deployment 1.11.5.final -...

WordPress theme Betheme code-related vulnerabilities

WordPress is a blogging platform developed in PHP by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress theme is a theme for WordPress. A deserialization vulnerability exists in WordPress Plugin Betheme them plugin 26.5.1.4 and...

CVE-2022-41939

knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious lifecycle container. This issues has bee...

CVE-2022-41939 Credential exposure when running third-party builders in knative/func

knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious lifecycle container. This issues has bee...

How DevOps can protect cloud applications from cyberattacks

Many organizations today are moving away from centralized on-prem operations and towards highly scalable cloud solutions such as Amazon’s AWS Lambda functionality. This provides cost-saving benefits and reduces the overall management of an enterprise tech stack. Cloud computing architecture also...

OESA-2022-2104 libpq security update

PostgreSQL is a powerful, open source object-relational database system that uses and extends the SQL language combined with many features that safely store and scale the most complicated data workloads. This package provides the essential shared library for any PostgreSQL client program or...

Rocky Linux 8 : php:8.0 (RLSA-2022:7624)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:7624 advisory. - In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT filter and min/max limits, ...

Design/Logic Flaw

Initialization function in PnpSmm could lead to SMRAM corruption when using subsequent PNP SMI functions Initialization function in PnpSmm could lead to SMRAM corruption when using subsequent PNP SMI functions. This issue was discovered by Insyde engineering during a security review. Fixed in:...

golang: net: lookup functions may return invalid host names

A flaw was found in Go. The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in the net package and methods on the Resolver type, may return arbitrary values retrieved from DNS, allowing injection of unexpected contents. The highest threat from this vulnerability is to integri...

kernel: sfc: fix kernel panic when creating VF

In the Linux kernel, the following vulnerability has been resolved: sfc: fix kernel panic when creating VF When creating VFs a kernel panic can happen when calling to efxef10tryupdatenicstatsvf. When releasing a DMA coherent buffer, sometimes, I don't know in what specific circumstances, it has t...

kernel: ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero

In the Linux kernel, the following vulnerability has been resolved: ixgbe: Add locking to prevent panic when setting sriovnumvfs to zero It is possible to disable VFs while the PF driver is processing requests from the VF driver. This can result in a panic. BUG: unable to handle kernel paging...

golang: go/parser: stack exhaustion in all Parse* functions

A flaw was found in the golang standard library, go/parser. When calling any Parse functions on the Go source code, which contains deeply nested types or declarations, a panic can occur due to stack exhaustion. This issue allows an attacker to impact system availability...

CVE-2022-30771: Out-of-bounds Write

Initialization function in PnpSmm could lead to SMRAM corruption when using subsequent PNP SMI functions Initialization function in PnpSmm could lead to SMRAM corruption when using subsequent PNP SMI functions. This issue was discovered by Insyde engineering during a security review. Fixed in:...

CVE-2022-30771

Initialization function in PnpSmm could lead to SMRAM corruption when using subsequent PNP SMI functions Initialization function in PnpSmm could lead to SMRAM corruption when using subsequent PNP SMI functions. This issue was discovered by Insyde engineering during a security review. Fixed in:...

CVE-2022-29276

CVE-2022-29276 affects the AhciBusDxe SMI handling, where untrusted inputs can lead to SMRAM corruption. The issue is documented across multiple sources (NVD, Red Hat, PRION/PTSecurity entries) and is tied to the AhciBusDxe component prior to specific kernel revisions. Reported root cause: SMI fu...