2887 matches found
kernel: save/restore speculative MSRs during S3 suspend/resume
A flaw was found in the Linux kernel X86 CPU Power management when resuming CPU from suspend-to-RAM. This issue could allow a local user unauthorized access to memory from the CPU...
SUSE SLES15: kernel-livepatch-5_14_21-150500_53-default / etc (SUSE-SU-2023:3630-1)
The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3630-1 advisory. This update for the Linux Kernel 5.14.21-15050053 fixes several issues. The following security issues were fixed: - CVE-2023-32233: Fixed a...
SUSE SLES15 Security Update : kernel (Live Patch 6 for SLE 15 SP4) (SUSE-SU-2023:3644-1)
The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3644-1 advisory. This update for the Linux Kernel 5.14.21-1504002438 fixes several issues. The following security issues were fixed: - CVE-2023-32233: Fixed a...
SUSE SLES15 Security Update : kernel (Live Patch 24 for SLE 15 SP3) (SUSE-SU-2023:3594-1)
The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3594-1 advisory. This update for the Linux Kernel 5.3.18-1503005993 fixes several issues. The following security issues were fixed: - CVE-2023-32233: Fixed a...
Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2023-12792)
The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-12792 advisory. - A use-after-free flaw was found in vcsread in drivers/tty/vt/vcscreen.c in vcscreen in the Linux Kernel. This issue may allow an attacker with local user...
kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch requests
A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and anonymous sets in batch requests, which can lead to performing arbitrary reads and writes in kernel memory. This flaw allows a local user with CAPNETADMIN capability to crash or potentially...
Mozilla VPN Security Breach
Mozilla VPN is an open source virtual private network web browser extension, desktop application and mobile application from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla VPN Linux that stems from the application's invalid Polkit authentication check and...
Oracle Linux 7 : qemu (ELSA-2018-4198)
The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-4198 advisory. - i386: Define the Virt SSBD MSR and handling of it CVE-2018-3639 Konrad Rzeszutek Wilk Orabug: 28110449 CVE-2018-3639 - i386: define the AMD 'virt-ssbd' CPUID...
Oracle Linux 5 : ELSA-2018-1196-1: / kernel (ELSA-2018-11961)
The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-11961 advisory. - Backport CVE-2017-5715 to RHCK/OL5 orabug 27787723 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. No...
RESTEasy: creation of insecure temp files
In RESTEasy the insecure File.createTempFile is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user...
CVE-2023-32338 IBM Sterling Secure Proxy information disclosure
IBM Sterling Secure Proxy and IBM Sterling External Authentication Server 6.0.3 and 6.1.0 stores user credentials in plain clear text which can be read by a local user with container access. IBM X-Force ID: 255585...
Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2023-12759)
The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12759 advisory. - xfrm: fix crash in XFRMMSGGETSA netlink handler Vegard Nossum Orabug: 35598955 CVE-2023-3106 - netfilter: nftables: validate registers coming fr...
PT-2023-4835 · Mozilla · Vpn
Name of the Vulnerable Software and Affected Versions: Mozilla VPN client for Linux versions prior to 2.16.1 Description: The issue is related to an invalid Polkit Authentication check and missing authentication requirements for D-Bus methods, allowing any local user to configure arbitrary VPN...
gawk 缓冲区错误漏洞
gawk is a programming language from the GUN project. A security vulnerability exists in gawk versions 5.0.0 through 5.1.0, which stems from an out-of-bounds read error that allows local users to access potentially sensitive information...
SUSE SLES15: cluster-md-kmp-azure / dlm-kmp-azure / gfs2-kmp-azure / etc (SUSE-SU-2023:3376-1)
The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3376-1 advisory. The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security and bugfixes. The following...
CVE-2023-4328
Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Windows...
rust-cargo: cargo does not respect the umask when extracting dependencies
A flaw was found in the rust-cargo package. Cargo, as bundled with the Rust compiler, did not respect the umask when extracting dependency tarballs and caching the extraction for future builds. If a dependency contained files with 0777 permissions, another local user could edit the cache of the...
DEBIAN-CVE-2023-38497
Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local...
SUSE CVE-2023-4104
An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitrary VPN setups. This bug only affects Mozilla VPN on Linux. Other operating systems are unaffected. This vulnerability affects Mozilla VPN 2.16.1 Linux...