SUSE-SU-2021:4097-1 Security update for storm-kit

This update for storm-kit fixes the following issues: - Remove JndiLookup from log4j 2.x jars during build to prevent 'log4shell' code injection. bsc1193641, bsc1193611, CVE-2021-44228 - Remove JMSAppender from log4j 1.2.x jars during build to prevent attacks when JMS is enabled bsc1193641,...

OESA-2021-1458 edk2 security update

EFI Development Kit II. Security Fixes: BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting PcdFirmwarePerformanceDataTableS3Support to FALSE.CVE-2021-28216...

Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center

Windows 10 and Windows 11 have continued to raise the security bar for drivers running in the kernel. Kernel-mode driver publishers must pass the Hardware Lab Kit HLK compatibility tests, malware scanning, and prove their identity through extended validation EV certificates. This has significantl...

SUSE: Security Advisory (SUSE-SU-2021:3939-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-44047

A use-after-free vulnerability exists when reading a DWF/DWFX file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists with parsing DWF/DWFX files. Crafted data in a DWF/DWFX file and lack of proper validation of input data can trigger a write operation past the end ...

Open Design Alliance Drawings SDK Out-of-Bounds Writing Vulnerability (CNVD-2022-01426)

Open Design Alliance Drawings SDK is a software development kit for drawing design applications from Open Design Alliance, Inc. The package provides access to data in .dwg and .dgn through a convenient, object-oriented API, C API, support for repair files, support for . The vulnerability can be...

Open Design Alliance Drawings SDK Post-release Reuse Vulnerability (CNVD-2022-00615)

The Open Design Alliance Drawings SDK is a software development kit for drawing design from Open Design Alliance, Inc. The Open Design Alliance Drawings SDK is vulnerable to a post-release reuse vulnerability caused by failure to verify the existence of an object before performing operations on i...

svnserver.informatik.kit.edu Cross Site Scripting vulnerability OBB-2289171

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Moddable SDK Heap Buffer Overflow Vulnerability (CNVD-2021-90317)

Moddable SDK is a software development kit SDK for IoT embedded software development from Moddable U.S.A. A buffer error vulnerability exists in Moddable SDK v10.5.0, which originates in the software component module /modules/network/wifi/esp/modwifi. c is vulnerable to a heap-based buffer...

Open Design Alliance Drawings SDK Resource Management Error Vulnerability

Open Design Alliance Drawings SDK is a software development kit for drawing design applications from Open Design Alliance, Inc. The development package provides access to data in .dwg and .dgn through a convenient, object-oriented API that provides a C API, support for repair files, support for t...

Moddable SDK 缓冲区错误漏洞

Moddable SDK is a software development kit SDK for IoT embedded software development from Moddable, Inc. A buffer overflow vulnerability exists in Moddable SDK v10.5.0, which originates in the /moddable/xs/sources/xsSymbol.c file A heap-based buffer overflow vulnerability exists in the fxIDToStri...

Moddable SDK 缓冲区错误漏洞

Moddable SDK is a software development kit SDK for IoT embedded software development from Moddable U.S.A. A buffer error vulnerability exists in Moddable SDK v10.5.0, which originates in the software component module /modules/network/wifi/esp/modwifi. c is vulnerable to a heap-based buffer...

CVE-2021-33093

Insecure inherited permissions in the installer for the IntelR NUC M15 Laptop Kit Serial IO driver pack before version 30.100.2104.1 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2021-33092

Incorrect default permissions in the installer for the IntelR NUC M15 Laptop Kit HID Event Filter driver pack before version 2.2.1.383 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2021-33095

CVE-2021-33095 describes an unquoted search path in the installer for the Intel NUC M15 Laptop Kit Keyboard LED Service driver pack prior to 1.0.0.4. Affected product/component: Intel NUC M15 Laptop Kit Keyboard LED Service driver pack (before 1.0.0.4). Root cause: unquoted search path in the ins...

CVE-2021-33095

Unquoted search path in the installer for the IntelR NUC M15 Laptop Kit Keyboard LED Service driver pack before version 1.0.0.4 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2021-33092

Intel NUC M15 Laptop Kit HID Event Filter driver pack has an issue: incorrect default installer permissions before version 2.2.1.383 may allow an authenticated local user to escalate privileges. The Red Hat/Intel advisory confirms the same CVE (CVE-2021-33092) and notes a local-access/vector scen...

CVE-2021-33091

This CVE affects the Intel NUC M15 Laptop Kit audio driver pack. The root cause is insecure inherited permissions in the installer, before version 1.3, which may allow an authenticated user to escalate privileges via local access. The Red Hat and NVD entries corroborate the same issue. Mitigation...

OPENSUSE-SU-2021:1480-1 Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues: Update to 11.0.13+8 October 2021 CPU - CVE-2021-35550, bsc1191901: Update the default enabled cipher suites preference - CVE-2021-35565, bsc1191909: com.sun.net.HttpsServer spins on TLS session close - CVE-2021-35556, bsc1191910: Richer...

Open Design Alliance Drawings SDK 资源管理错误漏洞

Open Design Alliance Drawings SDK is a software development kit for drawing design applications from Open Design Alliance, Inc. The development package provides access to data in .dwg and .dgn through a convenient, object-oriented API that provides a C API, support for repair files, support for t...