UVI-2021-1001626 drm/nouveau: avoid a use-after-free when BO init fails

drm/nouveau: avoid a use-after-free when BO init fails This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.73 by commit...

OESA-2021-1372 cloud-init security update

Cloud-init is the defacto multi-distribution package that handles early initialization of a cloud instance. Security Fixes: CVE-2021-3429...

WP Mega Menu < 1.4.0 - Unauthenticated Arbitrary Post Access

The plugin does not properly check for capability and CSRF due to a logic flaw, in its exporttheme and exportwpmegamenunavmenu methods, hooked to admininit. As a result, unauthenticated users can call them and access arbitrary post data, including password protected or private ones. PoC Access an...

OSV-2021-1269 Use-of-uninitialized-value in std::__1::basic_ostream<char, std::__1::char_traits<char> >& std::__1::__put_cha

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38777 Crash type: Use-of-uninitialized-value Crash state: std::1::basicostream & std::1::putcha S2LaxPolylineShape::Init S2LaxPolylineShape::S2LaxPolylineShape...

USN-5070-1 linux, linux-aws, linux-aws-5.11, linux-azure, linux-azure-5.11, linux-gcp, linux-hwe-5.11, linux-kvm, linux-oracle, linux-oracle-5.11, linux-raspi vulnerabilities

Maxim Levitsky and Paolo Bonzini discovered that the KVM hypervisor implementation for AMD processors in the Linux kernel allowed a guest VM to disable restrictions on VMLOAD/VMSAVE in a nested guest. An attacker in a guest VM could use this to read or write portions of the host's physical memory...

PT-2021-7629

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw was found in the filelock init function in fs/locks.c of the Linux kernel. This issue can lead to host memory exhaustion due to memcg not limiting the number of Portable Operating...

RHEL 8 : cloud-init (RHSA-2021:3371)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:3371 advisory. The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to...

cloud-init: randomly generated passwords logged in clear-text to world-readable file

A flaw was found in cloud-init. When a system is configured through cloud-init and the "Set Passwords" module is used with "chpasswd" directive and "RANDOM", the randomly generated password for the relative user is written in clear-text in a file readable by any existing user of the system. The...

Moderate: Red Hat Security Advisory: cloud-init security update

An update for cloud-init is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

Security update for qemu (important)

openSUSE Security Update: Security update for qemu Announcement ID: openSUSE-SU-2021:1202-1 Rating: important References: 1180432 1180433 1180434 1180435 1182651 1186012 1187364 1187365 1187366 1187367 1187499 1187529 1187538 1187539 1189145 Cross-References: CVE-2020-35503 CVE-2020-35504...

Out of bounds read in lazy-init

An issue was discovered in the lazy-init crate through 2021-01-17 for Rust. Lazy lacks a Send bound, leading to a data race...

GHSA-W47J-HQPF-QW9W Out of bounds read in lazy-init

An issue was discovered in the lazy-init crate through 2021-01-17 for Rust. Lazy lacks a Send bound, leading to a data race...

addr2line (0.6.0), backtrace (>=0.3.6, <=0.3.9) +11 more potentially affected by CVE-2021-25901 via lazy-init (>=0.1.1, <=0.3.0)

lazy-init CARGO version =0.1.1, =0.3.6, =0.1.0, =0.1.0, =0.1.0, =0.7.0, =0.4.0, =0.4.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.3.0 Source cves: CVE-2021-25901 Source advisory: OSV:GHSA-W47J-HQPF-QW9W...

DEBIAN-CVE-2021-38171

adtsdecodeextradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the initgetbits return value, which is a necessary step because the second argument to initgetbits can be crafted...

USN-5045-1 linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities

Norbert Slusarek discovered that the CAN broadcast manger bcm protocol implementation in the Linux kernel did not properly initialize memory in some situations. A local attacker could use this to expose sensitive information kernel memory. CVE-2021-34693 It was discovered that the bluetooth...

Moderate: Red Hat Security Advisory: cloud-init security update

An update for cloud-init is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

cloud-init: randomly generated passwords logged in clear-text to world-readable file

A flaw was found in cloud-init. When a system is configured through cloud-init and the "Set Passwords" module is used with "chpasswd" directive and "RANDOM", the randomly generated password for the relative user is written in clear-text in a file readable by any existing user of the system. The...

RHEL 8 : cloud-init (RHSA-2021:3177)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:3177 advisory. The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to...

qemu security update

15:4.2.1-11.el7 - pvrdma: Fix the ring init error flow CVE-2021-3608 Marcel Apfelbaum Orabug: 33120142 CVE-2021-3608 - pvrdma: Ensure correct input on ring init CVE-2021-3607 Marcel Apfelbaum Orabug: 33120146 CVE-2021-3607 - hw/rdma: Fix possible mremap overflow in the pvrdma device CVE-2021-3582...

CentOS 8 : cloud-init (CESA-2021:3081)

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2021:3081 advisory. - cloud-init: randomly generated passwords logged in clear-text to world-readable file CVE-2021-3429 Note that Nessus has not tested for this issue but has...