kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc

In the Linux kernel, the following vulnerability has been resolved: tty: ttybuffer: Fix the softlockup issue in flushtoldisc When running ltp testcaseltp/testcases/kernel/pty/pty04.c with arm64, there is a soft lockup, which look like this one: Workqueue: eventsunbound flushtoldisc Call trace:...

golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm

A flaw was discovered in Go's net/http standard library package. When parsing a multipart form either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile, limits on the total size of the parsed form were not applied to the...

Checking excessively long DSA keys or parameters may be very slow

OpenSSL contains an unbounded computation flaw when performing checks on excessively large DSA keys or parameters, which could lead to a denial-of-service DoS attack. The OpenSSL pkey, pkeyparam command line apps, and FIPS providers are affected...

PT-2024-8518 · Fortinet · Fortimanager +2

Name of the Vulnerable Software and Affected Versions: FortiManager versions 7.4.0 through 7.4.2 and prior to 7.2.5 FortiAnalyzer versions 7.4.0 through 7.4.2 and prior to 7.2.5 FortiAnalyzer-BigData versions 7.4.0 and prior to 7.2.7 Description: The issue is related to errors in handling relativ...

PT-2024-24120 · Fortinet · Fortimanager +2

Name of the Vulnerable Software and Affected Versions: FortiManager versions 7.4.0 through 7.4.2 and before 7.2.5 FortiAnalyzer versions 7.4.0 through 7.4.2 and before 7.2.5 FortiAnalyzer-BigData versions 7.4.0 and before 7.2.7 Description: A stack-based buffer overflow issue allows a privileged...

PT-2024-8519 · Fortinet · Fortimanager +2

Name of the Vulnerable Software and Affected Versions: Fortinet FortiManager versions 7.4.0 through 7.4.2 and before 7.2.5 Fortinet FortiAnalyzer versions 7.4.0 through 7.4.2 and before 7.2.5 Fortinet FortiAnalyzer-BigData before 7.4.0 Description: The issue is related to improper neutralization ...

Moderate: toolbox security update

Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI. Security Fixes: golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in...

Huawei EulerOS: Security Advisory for vim (EulerOS-SA-2024-2841)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for vim (EulerOS-SA-2024-2898)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion

A flaw was found in the go/build/constraint package of the Golang standard library. Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion...

EulerOS 2.0 SP9 : vim (EulerOS-SA-2024-2823)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source command line text editor. Vim v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack...

EulerOS 2.0 SP9 : vim (EulerOS-SA-2024-2841)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source command line text editor. Vim v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack...

Rendezvous v1 Connections fail after setting PortNumber argument on VDA Command Line Installs

After installing VDA with a custom port number with the commandline argument: /portnumber NNNN where NNNN is the port number, and runningxaxdcloudproxy.exe -VDAPORT NNNN on the cloud connectors, Rendezvous v1 connections to VDA fail. Network traces show that Cloud Connector attempts to reach...

EulerOS 2.0 SP10 : vim (EulerOS-SA-2024-2898)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source command line text editor.double-free in dialogchanged in Vim v9.1.0648.When abandoning a buffer, Vim may ask the user what to d...

Vulnerabilities fixed in Aruba Networks ArubaOS

Aruba Networks has fixed vulnerabilities in ArubaOS. A malicious party could exploit the vulnerabilities to execute arbitrary commands on the underlying operating system. For successful abuse, the malicious party must have access to the management interface, or command-line. It is good practice n...

Juniper Junos OS Vulnerability (JSA88106)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA88106 advisory. - An Incorrect Default Permissions vulnerability in the command line interface CLI of Juniper Networks Junos OS Evolved allows a low privileged local attacker to view NETCON...

UBUNTU-CVE-2024-50340

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...

Symfony has an incorrect response from Validator when input ends with `\n`

Description It is possible to trick a Validator configured with a regular expression using the $ metacharacters, with an input ending with \n. Resolution Symfony now uses the D regex modifier to match the entire input. The patch for this issue is available here for branch 5.4. Credits We would li...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection by replacing cmd.exe or placing a fake one in the working directory, which will be executed by ExecutableFinder.php when preparing command arguments. Note: This vulnerability only affects applications running on...

Access Restriction Bypass

Overview symfony/symfony is a PHP framework for web applications and a set of reusable PHP components. Affected versions of this package are vulnerable to Access Restriction Bypass when constructing functions in SymfoyRuntime.php, which allows the user to change environment or debug mode by...