Pluto security vulnerabilities

Pluto is a unique language for Lua open-sourced by PlutoLang. It is used for general-purpose programming. A security vulnerability exists in Pluto versions 0.9.0 through 0.9.2, which stems from a vulnerability that allows an attacker to spoof Pluto with a specially crafted certificate for a remot...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a security flaw in the call to the connect function from the cfg802.11 layer when lockdep is enabled...

Moderate: Red Hat Security Advisory: gnutls security update

An update for gnutls is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Low: Red Hat Security Advisory: openssl and openssl-fips-provider security update

An update for openssl and openssl-fips-provider is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges.

A flaw was found in the Golang crypto/tls standard library. In previous versions, the package was vulnerable to a Timing Side Channel attack by observing the time it took for RSA-based TLS key exchanges, which was not constant. This flaw allows a malicious user to gather information from the...

golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges.

A flaw was found in the Golang crypto/tls standard library. In previous versions, the package was vulnerable to a Timing Side Channel attack by observing the time it took for RSA-based TLS key exchanges, which was not constant. This flaw allows a malicious user to gather information from the...

kernel: Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcildisc,serdev: check percpuinitrwsem failure syzbot is reporting NULL pointer dereference at hciuartttyclose 1, for rcusyncenter is called without rcusyncinit due to hciuartttyopen ignoring percpuinitrwsem failure...

kernel: block/rq_qos: protect rq_qos apis with a new lock

Multiple race condition vulnerabilities were found in the block layer's request quality of service rqqos subsystem in the Linux kernel. The rqqos APIs lacked proper synchronization, leading to: concurrent writes to q-rqqos causing data corruption, NULL pointer dereferences when rqqosexit races wi...

kernel: block, bfq: Fix division by zero error on zero wsum

A division by zero error was found in the BFQ I/O scheduler. When the weighted sum of I/O priorities becomes zero, the limit calculation divides by zero, causing a kernel crash...

kernel: tls: race between tx work scheduling and socket close

A race condition vulnerability was found in the tls subsystem of the Linux kernel. The submitting thread recvmsg/sendmsg may exit as soon as the async crypto handler calls complete, which could lead to undefined behavior and a denial of service...

SUSE CVE-2022-48652

In the Linux kernel, the following vulnerability has been resolved: ice: Fix crash by keep old cfg when update TCs more than queues There are problems if allocated queues less than Traffic Classes. Commit a632b2a4c920 "ice: ethtool: Prohibit improper channel config for DCB" already disallow setti...

Firefox Thunderbird UI Layer Limitation

The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird is related to an improper limitation on the visible layers of the user interface. Exploiting this vulnerability allows a remote attacker to compromise data integrity...

Moderate: gnutls security update

The gnutls package provide the GNU Transport Layer Security GnuTLS library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fixes: gnutls: vulnerable to Minerva side-channel information leak CVE-2024-28834 gnutls: potential crash during chain...

PT-2024-40732 · Git +1 · Pcapplusplus

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read error. Technical details about the crash include the involvement of pcpp::TelnetLayer::getFieldLen an...

PT-2024-40733 · Pcpp · Pcpp

Name of the Vulnerable Software and Affected Versions: pcpp affected versions not specified Description: The issue is related to a crash in the pcpp library, specifically in the pcpp::IPv6Layer destructor. The crash occurs due to a segmentation fault on an unknown address. Technical details about...

PT-2024-40748 · Git +1 · Pcapplusplus

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 2 crash has been reported. The crash involves the pcpp::BgpLayer::getHeaderLen, pcpp::Packet::shortenLayer, and...

UBUNTU-CVE-2022-48652

In the Linux kernel, the following vulnerability has been resolved: ice: Fix crash by keep old cfg when update TCs more than queues There are problems if allocated queues less than Traffic Classes. Commit a632b2a4c920 "ice: ethtool: Prohibit improper channel config for DCB" already disallow setti...

OESA-2024-1513 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploi...

Moderate: Red Hat Security Advisory: gnutls security update

An update for gnutls is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

PT-2024-13488

Name of the Vulnerable Software and Affected Versions Automattic Jetpack versions prior to 12.7 Description The issue is related to an Improper Restriction of Rendered UI Layers or Frames vulnerability, which allows Clickjacking. Recommendations For versions prior to 12.7, update to version 12.7 ...