SUSE-SU-2024:1204-1 Security update for tomcat10

This update for tomcat10 fixes the following issues: - CVE-2024-24549: Fixed denial of service during header validation for HTTP/2 stream bsc1221386 - CVE-2024-23672: Fixed denial of service due to malicious WebSocket client keeping connection open bsc1221385 Other fixes: - Update to Tomcat 10.1....

performancefunnels.com Cross Site Scripting vulnerability OBB-3914378

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Virtuozzo Hybrid Infrastructure 6.1 Hotfix 1 (6.1.0-247)

In this release, Virtuozzo Hybrid Infrastructure enables selective updates of specific Kubernetes node groups, as well as provides stability and performance improvements. Vulnerability id: VSTOR-83526 Cannot filter backup plans by using the "Disabled" status. Vulnerability id: VSTOR-83662 Added...

UBUNTU-CVE-2021-47190

In the Linux kernel, the following vulnerability has been resolved: perf bpf: Avoid memory leak from perfenvinsertbtf perfenvinsertbtf doesn't insert if a duplicate BTF id is encountered and this causes a memory leak. Modify the function to return a success/error value and then free the memory if...

The vulnerability of the pmproxy component in the monitoring and performance visualization software Performance Co-Pilot (PCP) allows a hacker to execute arbitrary commands.

The vulnerability of the pmproxy component in the Performance Co-Pilot PCP monitoring and performance visualization software relates to the disclosure of information in the erroneous data area. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with a zero length (but data is expected) the iSCSI target can crash with a NULL pointer dereference.

...

RLSA-2024:1644 Important: grafana-pcp security and bug fix update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloa...

Rocky Linux 8 : kernel-rt (RLSA-2024:1614)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:1614 advisory. - Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux filesystem modules allows Forced Integer Overflow.This issue affects openEul...

Rocky Linux 8 : kernel (RLSA-2024:1607)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:1607 advisory. - Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux filesystem modules allows Forced Integer Overflow.This issue affects openEul...

CVE-2024-26796

A flaw was found in the Linux kernel in the ctrgetwidth function within the perf subsystem for legacy systems. The issue occurs due to the function not being properly defined, which can lead to potential security risks. Mitigation Mitigation for this issue is either not available or the currently...

CVE-2024-26796

The CVE-2024-26796 vulnerability affects the Linux kernel perf subsystem on RISCV with the PMU legacy path. The root cause is that the ctr_get_width function was not defined for the legacy configuration (CONFIG_RISCV_PMU_LEGACY=y, CONFIG_RISCV_PMU_SBI=n), causing a NULL pointer dereference in per...

CVE-2024-26796 drivers: perf: ctr_get_width function for legacy is not defined

In the Linux kernel, the following vulnerability has been resolved: drivers: perf: ctrgetwidth function for legacy is not defined With parameters CONFIGRISCVPMULEGACY=y and CONFIGRISCVPMUSBI=n linux kernel crashes when you try perf record: $ perf record ls 46.749286 Unable to handle kernel NULL...

CVE-2024-26796

In the Linux kernel, the following vulnerability has been resolved: drivers: perf: ctrgetwidth function for legacy is not defined With parameters CONFIGRISCVPMULEGACY=y and CONFIGRISCVPMUSBI=n linux kernel crashes when you try perf record: $ perf record ls 46.749286 Unable to handle kernel NULL...

CVE-2024-26796 drivers: perf: ctr_get_width function for legacy is not defined

In the Linux kernel, the following vulnerability has been resolved: drivers: perf: ctrgetwidth function for legacy is not defined With parameters CONFIGRISCVPMULEGACY=y and CONFIGRISCVPMUSBI=n linux kernel crashes when you try perf record: $ perf record ls 46.749286 Unable to handle kernel NULL...

CVE-2024-26763

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: don't modify the data when using authenticated encryption It was said that authenticated encryption could produce invalid tag when the data that is being encrypted is modified 1. So, fix this problem by copying the data...

CVE-2024-26759

In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix race when skipping swapcache When skipping swapcache for SWPSYNCHRONOUSIO, if two or more threads swapin the same entry at the same time, they get different pages A, B. Before one thread T0 finishes the swapin and...

CVE-2024-26763

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: don't modify the data when using authenticated encryption It was said that authenticated encryption could produce invalid tag when the data that is being encrypted is modified 1. So, fix this problem by copying the data...

CVE-2024-26759

In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix race when skipping swapcache When skipping swapcache for SWPSYNCHRONOUSIO, if two or more threads swapin the same entry at the same time, they get different pages A, B. Before one thread T0 finishes the swapin and...

CVE-2024-26759 mm/swap: fix race when skipping swapcache

In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix race when skipping swapcache When skipping swapcache for SWPSYNCHRONOUSIO, if two or more threads swapin the same entry at the same time, they get different pages A, B. Before one thread T0 finishes the swapin and...

CVE-2024-26759 mm/swap: fix race when skipping swapcache

In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix race when skipping swapcache When skipping swapcache for SWPSYNCHRONOUSIO, if two or more threads swapin the same entry at the same time, they get different pages A, B. Before one thread T0 finishes the swapin and...