SUSE-SU-2023:4040-1 Security update for samba

This update for samba fixes the following issues: - CVE-2023-4091: Fixed a bug where a client can truncate file with read-only permissions. bsc1215904...

USN-6425-1 samba vulnerabilities

Sri Nagasubramanian discovered that the Samba aclxattr VFS module incorrectly handled read-only files. When Samba is configured to ignore system ACLs, a remote attacker could possibly use this issue to truncate read-only files. CVE-2023-4091 Andrew Bartlett discovered that Samba incorrectly handl...

CVE-2023-4091

A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "aclxattr" is configured with "aclxattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only acces...

UBUNTU-CVE-2023-4091

A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "aclxattr" is configured with "aclxattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only acces...

UBUNTU-CVE-2023-4154

A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers RODCs. This flaw allows RODCs and users possessing the GETCHANGES right to access all attributes, including sensitive...

Read-only Domain Controller Support for CVAD

In a virtual desktop 2203 CU3 infrastructure with a DMZ which has its own Read-Only Domain Controller RODC and a secured Citrix Worker that is only allowed to contact the RODC server the configuration doesn't work...

Fedora: Security Advisory (FEDORA-2023-aadd651a30)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 39 Update: erofs-utils-1.6-3.fc39

EROFS stands for Enhanced Read-Only File System. It aims to be a general read-only file system solution for various use cases instead of just focusing on saving storage space without considering runtime performance. This package includes tools to create, check, and extract EROFS images...

Fedora: Security Advisory for erofs-utils (FEDORA-2023-f838326992)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE CVE-2023-41053

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by SORTRO and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been...

Improper access control

An improper access control in Fortinet FortiSwitchManager version 7.2.0 through 7.2.2 7.0.0 through 7.0.1 may allow a remote authenticated read-only user to modify the interface settings via the API...

[SECURITY] Fedora 38 Update: erofs-utils-1.6-3.fc38

EROFS stands for Enhanced Read-Only File System. It aims to be a general read-only file system solution for various use cases instead of just focusing on saving storage space without considering runtime performance. This package includes tools to create, check, and extract EROFS images...

Oracle Linux 8 : container-tools:ol8 (ELSA-2020-1650)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1650 advisory. - A malicious container image can consume an unbounded amount of memory when being pulled to a container runtime host, such as Red Hat Enterprise Linux...

DEBIAN-CVE-2023-41053

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by SORTRO and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been...

Upgraded Q -> 2 from #26 [1693915911684]

Judge has assessed an item in Issue 26 as 2 risk. The relevant finding follows: Curve Read-only Reentrancy can increase the price of some CurveStableCollateral --- The text was updated successfully, but these errors were encountered: All reactions...

Prompt Error "Feature is not implemented" after Read-Only users login GUI

Read-only user login GUI and get an error "Feature is not implemented"...

Improper log output when using GitHub Status Notifications in spinnaker

Impact ONLY IMPACTS those use GitHub Status Notifications Log output when updating GitHub status is improperly set to FULL always. It's recommended to apply the patch and rotate the GitHub token used for github status notifications. Given that this would output github tokens to a log system, the...

CVE-2023-39348 Improper log output when using GitHub Status Notifications in spinnaker

Spinnaker is an open source, multi-cloud continuous delivery platform. Log output when updating GitHub status is improperly set to FULL always. It's recommended to apply the patch and rotate the GitHub token used for github status notifications. Given that this would output github tokens to a log...

CVE-2023-39348 Improper log output when using GitHub Status Notifications in spinnaker

Spinnaker is an open source, multi-cloud continuous delivery platform. Log output when updating GitHub status is improperly set to FULL always. It's recommended to apply the patch and rotate the GitHub token used for github status notifications. Given that this would output github tokens to a log...

PT-2023-9345

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Description A vulnerability in the web-based management interface could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This...