CVE-2024-43378 calamares-nixos-extensions LUKS keyfile exposure regression on legacy BIOS systems

calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users who installed NixOS through the graphical installer who used manual disk partitioning to create a setup where the system was booted via legacy BIOS rather than UEFI; some disk partitio...

PT-2024-30540 · Unknown · Calamares-Nixos-Extensions

Name of the Vulnerable Software and Affected Versions: calamares-nixos-extensions versions prior to 0.3.17 Description: The issue affects users who installed NixOS through the graphical installer using manual disk partitioning, where the system boots via legacy BIOS, some disk partitions are...

SUSE SLES15: kernel-azure / kernel-azure-devel / kernel-devel-azure / etc (SUSE-SU-2024:2896-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2896-1 advisory. The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes. The following security bugs were...

kernel: hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field

A vulnerability was found in the Linux kernel's hwmon driver for the w83792d module where a NULL pointer dereference was caused by the lm75 obsolete structure field. During specific device read operations, if certain conditions are met, the driver may attempt to access a NULL pointer because this...

error handling in x86 IOMMU identity mapping

ISSUE DESCRIPTION Certain PCI devices in a system might be assigned Reserved Memory Regions specified via Reserved Memory Region Reporting, "RMRR" for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose...

August 13, 2024—KB5041847 (Security-only update)

None None...

kernel: netfilter: nf_tables: disallow anonymous set with timeout flag

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: disallow anonymous set with timeout flag Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFTSETEVAL to ensure legacy meters still work...

kernel: xfs: fix log recovery buffer allocation for the legacy h_size fixup

A security vulnerability has been discovered in the Linux kernel's XFS file system implementation, specifically within the xloglogrechblks function. This flaw arises from an inadequate log recovery buffer allocation during the processing of legacy header size adjustments. The vulnerability can be...

kernel: xfs: fix log recovery buffer allocation for the legacy h_size fixup

A security vulnerability has been discovered in the Linux kernel's XFS file system implementation, specifically within the xloglogrechblks function. This flaw arises from an inadequate log recovery buffer allocation during the processing of legacy header size adjustments. The vulnerability can be...

MAL-2024-7969 Malicious code in legacy-swc-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49e695d88baed2f53db3da619c1ea2230342d8f853e21cfba4ba15019326e6ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in legacy-swc-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49e695d88baed2f53db3da619c1ea2230342d8f853e21cfba4ba15019326e6ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2024-42150

In the Linux kernel, the following vulnerability has been resolved: net: txgbe: remove separate irq request for MSI and INTx When using MSI or INTx interrupts, requestirq for pdev-irq will conflict with requestthreadedirq for txgbe-misc.irq, to cause system crash. So remove txgberequestirq for...

DEBIAN-CVE-2024-42150

In the Linux kernel, the following vulnerability has been resolved: net: txgbe: remove separate irq request for MSI and INTx When using MSI or INTx interrupts, requestirq for pdev-irq will conflict with requestthreadedirq for txgbe-misc.irq, to cause system crash. So remove txgberequestirq for...

UBUNTU-CVE-2024-42113

In the Linux kernel, the following vulnerability has been resolved: net: txgbe: initialize numqvectors for MSI/INTx interrupts When using MSI/INTx interrupts, wx-numqvectors is uninitialized. Thus there will be kernel panic in wxallocqvectors to allocate queue vectors...

UBUNTU-CVE-2024-42150

In the Linux kernel, the following vulnerability has been resolved: net: txgbe: remove separate irq request for MSI and INTx When using MSI or INTx interrupts, requestirq for pdev-irq will conflict with requestthreadedirq for txgbe-misc.irq, to cause system crash. So remove txgberequestirq for...

PT-2024-10385 · Firebird · Firebird

Name of the Vulnerable Software and Affected Versions: Firebird component of "Популяционный раковый регистр" and "Госпитальный раковый регистр" affected versions not specified Description: The issue is related to the use of an insecure authentication method, Legacy Auth, in the Firebird component...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that originates from a conflict between requestirq in pdev-irq and requestthreadedirq in txgbemisc.irq in the net:txgbe modu...

DEBIAN-CVE-2024-40725

A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local...

ALPINE-CVE-2024-40725

A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local...

AZL-43414 CVE-2024-40725 affecting package httpd for versions less than 2.4.62-1

A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local...