PT-2023-35061

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.1.7 Description The issue is related to the io uring/io-wq component, where a worker is freed without being allocated for creation. The actual impact and attack plausibility have not yet been proven...

PT-2023-35259

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.164 Description The issue is related to the io uring/io-wq component, where a worker is freed without being allocated for creation. The actual impact and attack plausibility have not yet been proven...

PT-2023-35192

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.89 Description The issue is related to the io uring/io-wq component, where a worker is freed without being allocated for creation. The actual impact and attack plausibility have not yet been proven...

GHSA-4Q83-7CQ4-P6WG `tokio::io::ReadHalf<T>::unsplit` is Unsound

tokio::io::ReadHalf::unsplit can violate the Pin contract The soundness issue is described in the tokio/issues5372 Specific set of conditions needed to trigger an issue a !Unpin type in ReadHalf is unusual, combined with the difficulty of making any arbitrary use-after-free exploitable in Rust...

Security Bulletin: Vulnerability in Apache Commons IO affects IBM Process Mining (CVE-2021-29425)

Summary There is a vulnerability in Apache Commons IO that could allow aremote attacker to traverse directories on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2021-29425...

GSD-2023-1001787 io_uring/io-wq: only free worker if it was allocated for creation

iouring/io-wq: only free worker if it was allocated for creation This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.164 by commit...

GSD-2023-1001753 io_uring/io-wq: only free worker if it was allocated for creation

iouring/io-wq: only free worker if it was allocated for creation This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.89 by commit...

GSD-2023-1001691 io_uring/io-wq: only free worker if it was allocated for creation

iouring/io-wq: only free worker if it was allocated for creation This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.7 by commit...

PT-2023-34767 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.7 Description: The issue is related to the io uring/io-wq component, where a worker is freed without being allocated for creation. The actual impact and attack plausibility have not yet been proven...

PT-2023-34863 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.164 Description: The issue is related to the io uring/io-wq component, where a worker is freed without being allocated for creation. The actual impact and attack plausibility have not yet been proven...

PT-2023-34829 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.89 Description: The issue is related to the io uring/io-wq component, where a worker is freed without being allocated for creation. The actual impact and attack plausibility have not yet been proven...

PT-2023-34766 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.7 Description: The issue is related to io uring, where a lock overflowing occurs for IOPOLL. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2023-34806 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.7 Description: The issue is related to the io uring/poll component. It was introduced in version v6.0 and fixed in version v6.1.7. The actual impact and attack plausibility have not yet been proven...

PT-2023-34828 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.89 Description: The issue is related to io uring, where a lock overflowing occurs for IOPOLL. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2023-34744 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v6.1.7 through v6.1.8 Description: The issue is related to a potential security vulnerability in the io uring/poll component. It was introduced in version v6.1.7 and fixed in version v6.1.8. The actual impact and attack...

Malicious Package

Overview engine.io-client-v3 is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packa...

AZL-13169 CVE-2023-0468 affecting package kernel for versions less than 5.15.92.1-1

A use-after-free flaw was found in iouring/poll.c in iopollcheckevents in the iouring subcomponent in the Linux Kernel due to a race condition of pollrefs. This flaw may cause a NULL pointer dereference...

golang: io/fs: stack exhaustion in Glob

A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to impact availability...

SNC_io parser seh->twin() Component Confidential Data Access DoS

The vulnerability of the SNCioparser function: readvolume, seh-twin in the NefS2/SNCioparser.h component, and the algorithms from the Computational Geometry Library CGAL are related to unvalidated array indexing. Exploiting this vulnerability allows an attacker to gain access to confidential data...

SNC_io parser Heap Buffer Overflow DoS

Vulnerability of SNCio parser: The function readsedge in the NefS2/SNCio parser component relies on the snext function from the CGAL algorithm library. This vulnerability is related to unvalidated array indexing. Exploiting this vulnerability allows an attacker to gain access to confidential data...