Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities

Summary QRadar Suite Software includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version. Vulnerability Details...

Race Condition Vulnerability

github.com/moby/moby is vulnerable to a Race Condition. The vulnerability is due to the lack of synchronization mechanisms to manage concurrent write operations in the streamformatter package, allowing multiple operations to occur simultaneously and potentially result in data corruption or...

CVE-2024-24786 affecting package moby-engine for versions less than 24.0.9-13

CVE-2024-24786 affecting package moby-engine for versions less than 24.0.9-13. A patched version of the package is available...

CVE-2024-45337 affecting package moby-engine for versions less than 25.0.3-9

CVE-2024-45337 affecting package moby-engine for versions less than 25.0.3-9. A patched version of the package is available...

CVE-2024-45337 affecting package moby-compose for versions less than 2.17.3-9

CVE-2024-45337 affecting package moby-compose for versions less than 2.17.3-9. A patched version of the package is available...

CVE-2024-45337 affecting package moby-engine for versions less than 24.0.9-12

CVE-2024-45337 affecting package moby-engine for versions less than 24.0.9-12. A patched version of the package is available...

The vulnerability of the Moby container isolation system creation software, related to the swapping of the zero pointer, allows a intruder to trigger a service failure.

The vulnerability of the Moby container isolation system creation software is related to the manipulation of the zero pointer. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

CBL Mariner 2.0 Security Update: moby-engine (CVE-2024-36621)

The version of moby-engine installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-36621 advisory. - moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The...

CVE-2024-24786 affecting package moby-containerd-cc for versions less than 1.7.7-8

CVE-2024-24786 affecting package moby-containerd-cc for versions less than 1.7.7-8. A patched version of the package is available...

CVE-2024-24786 affecting package moby-cli for versions less than 24.0.9-6

CVE-2024-24786 affecting package moby-cli for versions less than 24.0.9-6. A patched version of the package is available...

CVE-2024-36621 affecting package moby-engine for versions less than 24.0.9-11

CVE-2024-36621 affecting package moby-engine for versions less than 24.0.9-11. A patched version of the package is available...

CVE-2024-36623 affecting package moby-engine for versions less than 24.0.9-11

CVE-2024-36623 affecting package moby-engine for versions less than 24.0.9-11. A patched version of the package is available...

CVE-2024-24786 affecting package moby-containerd for versions less than 1.6.26-8

CVE-2024-24786 affecting package moby-containerd for versions less than 1.6.26-8. A patched version of the package is available...

CVE-2024-24786 affecting package moby-buildx for versions less than 0.7.1-24

CVE-2024-24786 affecting package moby-buildx for versions less than 0.7.1-24. A patched version of the package is available...

NULL Pointer Dereference

github.com/moby/moby is vulnerable to a NULL Pointer Dereference. The vulnerability is due to improper handling of null pointers in the daemon/images/imagehistory.go file, which can lead to a crash or denial of service...

CBL Mariner 2.0 Security Update: docker-cli / moby-cli / moby-compose / moby-engine (CVE-2024-36623)

The version of docker-cli / moby-cli / moby-compose / moby-engine installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-36623 advisory. - moby through v25.0.3 has a Race Condition vulnerability in the...

CVE-2024-36623 affecting package moby-cli for versions less than 24.0.9-5

CVE-2024-36623 affecting package moby-cli for versions less than 24.0.9-5. A patched version of the package is available...

CVE-2024-36623 affecting package moby-compose for versions less than 2.17.3-8

CVE-2024-36623 affecting package moby-compose for versions less than 2.17.3-8. A patched version of the package is available...

OESA-2024-2557 docker security update

Docker is an open source project to build, ship and run any application as a lightweight container. Security Fixes: moby v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or...

OESA-2024-2556 docker security update

Docker is an open source project to build, ship and run any application as a lightweight container. Security Fixes: moby v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or...