kernel: fix race condition between mmget_not_zero()/get_task_mm() and core dumping

A flaw was found in the Linux kernel where the coredump implementation does not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs. This allows local users to obtain sensitive information, cause a denial of service DoS, or possibly have unspecified other impa...

kernel security update

kernel - 2.6.18-419.0.0.0.13 - x86/speculation/mds: Conditionally clear CPU buffers on idle entry Thomas Gleixner orabug 29821515 CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 - x86/speculation/mds: Call VERW on NMI path when returning to user Patrick Colp orabug 29821515...

OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0035) (Spectre)

The remote OracleVM system is missing necessary patches to address critical security updates : - scsi: libfc: Fixup discmutex handling in fcoe module Hannes Reinecke Orabug: 29511036 - scsi: libfc: sanitize EDTOV and RATOV setting in fcp Hannes Reinecke Orabug: 29511036 - sysctl: Fix kabi breakag...

Unbreakable Enterprise kernel security update

4.1.12-124.27.2 - x86/speculation/mds: Check for the right microcode before setting mitigation Kanth Ghatraju Orabug: 29797118 - vxlan: test dev-flags & IFFUP before accessing vxlan-dev-devaddr Venkat Venkatsubra Orabug: 29710939 - vxlan: test dev-flags & IFFUP before calling grocellsreceive Eric...

OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0022)

The remote OracleVM system is missing necessary patches to address critical security updates : - scsi: libfc: sanitize EDTOV and RATOV setting Hannes Reinecke Orabug: 25933179 - scsi: libfc: use configured rport EDTOV Hannes Reinecke Orabug: 25933179 - scsi: libfc: additional debugging messages...

Unbreakable Enterprise kernel security update

4.1.12-124.27.1 - scsi: libfc: sanitize EDTOV and RATOV setting Hannes Reinecke Orabug: 25933179 - scsi: libfc: use configured rport EDTOV Hannes Reinecke Orabug: 25933179 - scsi: libfc: additional debugging messages Hannes Reinecke Orabug: 25933179 - scsi: libfc: don't advance state machine for...

Rockwell Automation DSA 2/1 (100-DNY22S) 22.5 mm General Purpose Discrete I/O

Binary data 752741.prm...

Improper Access Control

Linux kernel is vulnerable to improper access control. The vulnerability exists because the mm subsystem in the Linux kernel does not properly enforce the CONFIGSTRICTDEVMEM protection mechanism. Local users could read or write to kernel memory locations in the first megabyte and bypass...

kernel security and bug fix update

3.10.0-957.12.1.OL7 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey bug 24817676 3.10.0-957.12.1 - kernel locking/rwsem: Fix possible missed wakeup Waiman Long 1690323...

Unbreakable Enterprise kernel security update

4.14.35-1844.4.5 - x86/apic/x2apic: set back affinity of a single interrupt to one cpu Mridula Shastry Orabug: 29510342 4.14.35-1844.4.4 - ext4: fix data corruption caused by unaligned direct AIO Lukas Czerner Orabug: 29598590 - swiotlb: checking whether swiotlb buffer is full with iotlbused Dong...

EulerOS Virtualization 2.5.4 : kernel (EulerOS-SA-2019-1229)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The kernel package contains the Linux kernel vmlinuz, the core of any Linux operating system. The kernel handles the basic...

OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0009)

The remote OracleVM system is missing necessary patches to address critical security updates : - NFS: commit direct writes even if they fail partially J. Bruce Fields Orabug: 28212440 - rds: update correct congestion map for loopback transport Mukesh Kacker Orabug: 29175685 - ext4: only look at t...

Unbreakable Enterprise kernel security update

4.1.12-124.26.1 - NFS: commit direct writes even if they fail partially J. Bruce Fields Orabug: 28212440 - rds: update correct congestion map for loopback transport Mukesh Kacker Orabug: 29175685 - ext4: only look at the bgflags field if it is valid Theodore Tso Orabug: 29316684 CVE-2018-10876...

kernel security and bug fix update

2.6.32-754.11.1.OL6 - Update genkey bug 25599697 2.6.32-754.11.1 - x86 mm/fault: Allow stack access below rsp Waiman Long 1644401 - sound alsa: rawmidi: Change resized buffers atomically Denys Vlasenko 1593083 CVE-2018-10902...

WordPress MM-Forms-Community 2.2.7 Shell Upload / SQL Injection

Exploit Title : WordPress MM-Forms-Community Plugins 2.2.7 Shell Upload and SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 26/01/2019 Vendor Homepage : wordpress.org Software Download Link : downloads.wordpress.org/plugin/mm-forms-community.zip...

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of service. A use-after-free UAF vulnerability in dogetmempolicy function in mm/mempolicy.c allows an attacker to cause a denial of service condition via malicious system calls...

CVE-2019-5489

CVE-2019-5489 affects the Linux kernel mincore() implementation (mm/mincore.c) up to version 4.19.13. It enables a local attacker to observe page cache access patterns of other processes sharing memory, leading to potential information disclosure; the impact is described as partial confidentialit...

Fedora 28 : xen (2018-a7862a75f5)

preemption checks bypassed in x86 PV MM handling XSA-264, CVE-2018-12891 1595959 x86: DB exception safety check can be triggered by a guest XSA-265, CVE-2018-12893 1595958 libxl fails to honour readonly flag on HVM emulated SCSI disks XSA-266, CVE-2018-12892 1595957 Note that Tenable Network...

CVE-2018-18397

The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file if the user has read-only access to that file, and that file contains holes, related to...

Design/Logic Flaw

CommuniGate Pro 6.2 allows stored XSS via a message body in Pronto! Mail Composer, which is mishandled in /MIME/INBOX-MM-1/ if the raw email link in .txt format is modified and then renamed with a .html or .wssp extension...