Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: stack overflow in doprocdointvec and procskipspaces CVE-2022-4378 ALSA: pcm: Move rwsem lock inside sndctlelemread to prevent UAF CVE-2023-0266 kernel: FUSE filesystem low-privileged user...

lag-wfbm-rlp.de Cross Site Scripting vulnerability OBB-3200410

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GSD-2023-1000054 net/mlx5: Lag, avoid lockdep warnings

net/mlx5: Lag, avoid lockdep warnings This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.13 by commit ff24a802204620214afa75a5e64280f40015e399...

PT-2023-33131 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.13 Description: The issue is related to the net/mlx5 component, which may cause a lag and produce lockdep warnings. The actual impact and potential for exploitation have not been proven yet. Recommendations...

CVE-2023-22403

An Allocation of Resources Without Limits or Throttling vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service DoS. On QFX10K Series, Inter-Chassis Control Protocol ICCP is used in MC-LAG...

Design/Logic Flaw

An Allocation of Resources Without Limits or Throttling vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service DoS. On QFX10K Series, Inter-Chassis Control Protocol ICCP is used in MC-LAG...

lag-wfbm-rlp.de Cross Site Scripting vulnerability OBB-3051301

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Juniper Junos OS DoS (JSA69873)

The version of Junos OS installed on the remote host is affected by a denial of service DoS vulnerability. On QFX10000 Series devices using Juniper Networks Junos OS when configured as transit IP/MPLS penultimate hop popping PHP nodes with link aggregation group LAG interfaces, an Improper...

CVE-2022-22223

On QFX10000 Series devices using Juniper Networks Junos OS when configured as transit IP/MPLS penultimate hop popping PHP nodes with link aggregation group LAG interfaces, an Improper Validation of Specified Index, Position, or Offset in Input weakness allows an attacker sending certain IP packet...

Input validation

On QFX10000 Series devices using Juniper Networks Junos OS when configured as transit IP/MPLS penultimate hop popping PHP nodes with link aggregation group LAG interfaces, an Improper Validation of Specified Index, Position, or Offset in Input weakness allows an attacker sending certain IP packet...

CVE-2022-22223 Junos OS: QFX10000 Series: In IP/MPLS PHP node scenarios upon receipt of certain crafted packets multiple interfaces in LAG configurations may detach.

On QFX10000 Series devices using Juniper Networks Junos OS when configured as transit IP/MPLS penultimate hop popping PHP nodes with link aggregation group LAG interfaces, an Improper Validation of Specified Index, Position, or Offset in Input weakness allows an attacker sending certain IP packet...

PT-2022-33312 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.6 Description: The issue concerns a logic flaw in the LAG Link Aggregation functionality over the MLX5 LAG FLAG NDEVS READY flag. The actual impact and potential for attack have not been proven yet...

CVE-2022-2447

A flaw was found in Keystone. There is a time lag up to one hour in a default configuration between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected...

CVE-2022-2447

A flaw was found in Keystone. There is a time lag up to one hour in a default configuration between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected...

CVE-2022-2447

A flaw was found in Keystone. There is a time lag up to one hour in a default configuration between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected...

PT-2025-25928

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.18.0-rc5 for upstream min debug 2022 05 05 10 13 Description The issue is related to an asymmetry in setting and clearing the MLX5 LAG FLAG NDEVS READY flag in the Linux kernel's net/mlx5 module. This can lead ...

UBUNTU-CVE-2014-125024

A vulnerability was found in FFmpeg 2.0. It has been rated as critical. Affected by this issue is the function lagdecodeframe. The manipulation leads to memory corruption. The attack may be launched remotely. It is recommended to apply a patch to fix this issue...

FFmpeg 缓冲区错误漏洞

FFmpeg is a complete solution for recording, converting and streaming audio and video from the Ffmpeg team. A code execution vulnerability exists in the FFmpeg lagdecodeframe function, which could be exploited by attackers to execute arbitrary code on the system...

PT-2025-8267

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.18.0-rc7+ Description The issue is related to the Linux kernel, specifically with the mlx5 get next phys dev function, which was called without holding the interface lock. This problem was identified when a...

Bribe Rewards Not Collected In Current Period Will Be Lost Forever

Lines of code Vulnerability details High Bribe Rewards Not Collected In Current Period Will Be Lost Forever Vulnerability Details It was observed that if the bribe rewards are not collected in the current period, they will not be accrued to future epoch, and they will be lost forever...