R-TPT: Improving Adversarial Robustness of Vision-Language Models through Test-Time Prompt Tuning

Vision-language models VLMs, such as CLIP, have gained significant popularity as foundation models, with numerous fine-tuning methods developed to enhance performance on downstream tasks. However, due to their inherent vulnerability and the common practice of selecting from a limited set of...

GHSA-CWRH-575J-8VR3 Karmada Tar Slips in CRDs archive extraction

Impact What kind of vulnerability is it? Who is impacted? Both in karmadactl and karmada-operator, it is possible to supply a filesystem path, or an HTTPs URL to retrieve the custom resource definitionsCRDs needed by karmada. The CRDs are downloaded as a gzipped tarfile and are vulnerable to a...

CVE-2024-53096

CVE-2024-53096: Linux kernel patch resolves faulty mmap_region() error path. Key changes move core logic into __mmap_region(), perform upfront validations, and unwind writable/ seal checks earlier. Effects include preallocating iterator state before file-backed hooks, early handling of mapping_ma...

CVE-2024-53096

In the Linux kernel, the following vulnerability has been resolved: mm: resolve faulty mmapregion error path behaviour The mmapregion function is somewhat terrifying, with spaghetti-like control flow and numerous means by which issues can arise and incomplete state, memory leaks and other...

CLSA-2024-1731430561 kernel: Fix of 31 CVEs

driver core: bus: Fix double free in driver API busregister CVE-2024-50055 - net: tun: Fix use-after-free in tundetach CVE-2022-49014 - memcg: fix possible use-after-free in memcgwriteeventcontrol CVE-2022-48988 - ppp: fix pppasyncencode illegal access CVE-2024-50035 - drivers: media:...

slip: make slhc_remember() more robust against malicious packets

...

Security update for 389-ds

This update for 389-ds fixes the following issues: Persist extracted key path for ldapsslclientinit over repeat invocations bsc1230852 Re-enable use of .dsrc basedn for dsidm commands bsc1231462 Update to version 2.2.10git18.20ce9289: RFE: Use previously extracted key path Update dsidm to...

Evaluating the Effectiveness of Reward Modeling of Generative AI Systems

New research evaluating the effectiveness of reward modeling during Reinforcement Learning from Human Feedback RLHF: "SEAL: Systematic Error Analysis for Value ALignment." The paper introduces quantitative metrics for evaluating the effectiveness of modeling and aligning human values: Abstract:...

CVE-2021-47603

In the Linux kernel, the following vulnerability has been resolved: audit: improve robustness of the audit queue handling If the audit daemon were ever to get stuck in a stopped state the kernel's kauditdthread could get blocked attempting to send audit records to the userspace audit daemon. With...

CVE-2024-35991

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue drainworkqueue cannot be called safely in a spinlocked context due to possible task rescheduling. In the multi-task scenario, calling queuework while drainworkqueue...

CVE-2024-35991

CVE-2024-35991: In the Linux kernel, idxd dmaengine code changed from a spinlock-protected event log workqueue to a mutex-protected approach to safely call drain_workqueue(). The root cause was calling drain_workqueue() while holding a spinlock, risking a Call Trace due to possible task reschedul...

CVE-2023-52070

Removed by vendor...

CVE-2024-23076

Removed by vendor...

CVE-2024-23077

Removed by vendor...

SUSE-SU-2024:1141-1 Security update for python-Django

This update for python-Django fixes the following issues: - CVE-2024-27351: Align the patch with the upstream one and make it more robust. bsc1220358...

CVE-2024-22949

Removed by vendor...

Radamsa - A General-Purpose Fuzzer

Radamsa is a test case generator for robustness testing, a.k.a. a fuzzer. It is typically used to test how well a program can withstand malformed and potentially malicious inputs. It works by reading sample files of valid data and generating interestringly different outputs from them. The main...

CVE-2021-47167

In the Linux kernel, the following vulnerability has been resolved: NFS: Fix an Oopsable condition in nfspageioaddrequest Ensure that nfspageioerrorcleanup resets the mirror array contents, so that the structure reflects the fact that it is now empty. Also change the test in nfspageiodoaddrequest...

CVE-2021-47167

In the Linux kernel, the following vulnerability has been resolved: NFS: Fix an Oopsable condition in nfspageioaddrequest Ensure that nfspageioerrorcleanup resets the mirror array contents, so that the structure reflects the fact that it is now empty. Also change the test in nfspageiodoaddrequest...

CVE-2024-28181 Arbitrary method invocation turbo_boost-commands

turboboost-commands is a set of commands to help you build robust reactive applications with Rails & Hotwire. TurboBoost Commands has existing protections in place to guarantee that only public methods on Command classes can be invoked; however, the existing checks aren't as robust as they should...