SUSE CVE-2021-38114

libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the initvlc function, a similar issue to CVE-2013-0868...

SUSE CVE-2021-42381

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hashinit function...

SUSE CVE-2022-2085

A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory. When allocating a buffer device, it relies on an initdeviceprocs defined for the device that uses it as a prototype that depends upon the number of bits per...

SUSE CVE-2022-3113

An issue was discovered in the Linux kernel through 5.16-rc6. mtkvcodecfwvpuinit in drivers/media/platform/mtk-vcodec/mtkvcodecfwvpu.c lacks check of the return value of devmkzalloc and will cause the null pointer dereference...

SUSE CVE-2022-3637

A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function jlinkinit of the file monitor/jlink.c of the component BlueZ. The manipulation leads to denial of service. It is recommended to apply a patch to fix this issue. The identifier of...

SUSE CVE-2022-23577

Tensorflow is an Open Source Machine Learning Framework. The implementation of GetInitOp is vulnerable to a crash caused by dereferencing a null pointer. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, ...

SUSE CVE-2022-23585

Tensorflow is an Open Source Machine Learning Framework. When decoding PNG images TensorFlow can produce a memory leak if the image is invalid. After calling png::CommonInitDecode..., &decode, the decode value contains allocated buffers which can only be freed by calling...

SUSE CVE-2022-26280

Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipxlzmaaloneinit...

SUSE CVE-2022-27384

An issue in the component Itemsubselect::initexprcachetracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service DoS via specially crafted SQL statements...

SUSE CVE-2022-27404

FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfntinitface...

SUSE CVE-2022-32083

MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Itemsubselect::initexprcachetracker...

SUSE CVE-2023-25586

A flaw was found in Binutils. A logic fail in the bfdinitsectiondecompressstatus function may lead to the use of an uninitialized variable that can cause a crash and local denial of service...

GSD-2023-1002271 efi: fix NULL-deref in init error path

efi: fix NULL-deref in init error path This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.270 by commit...

GSD-2023-1002235 efi: fix NULL-deref in init error path

efi: fix NULL-deref in init error path This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.229 by commit...

GSD-2023-1002184 efi: fix NULL-deref in init error path

efi: fix NULL-deref in init error path This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.164 by commit...

PT-2023-35332 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.272 Description: The issue is related to the elimination of anonymous module init and module exit in the net: mlx5 module. The actual impact and attack plausibility have not yet been proven. Recommendation...

PT-2023-35004 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.9 Description: The issue is related to the elimination of anonymous module init and module exit in the net: mlx5 module. The actual impact and attack plausibility have not yet been proven. It was introduced...

PT-2023-35123 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.92 Description: A possible memory leak was identified in the sdma transfer init function of the imx-sdma driver. The actual impact and attack plausibility have not yet been proven. Recommendations: For Lin...

PT-2023-35151 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.91 Description: The issue is related to the elimination of anonymous module init and module exit in the net: mlx5 module. The actual impact and attack plausibility have not yet been proven. Recommendations...

Metasploit Weekly Wrap-Up

Taking a stroll down memory lane Tomcat Init Script Privilege Escalation Do you remember the issue with Tomcat init script that was originally discovered by Dawid Golunski back in 2016 that led to privilege escalation? This week's Metasploit release includes an exploit module for CVE-2016-1240 by...