CVE-2024-35920

A vulnerability was found in the Linux kernel's MediaTek VCodec driver, caused by the absence of a lock to protect the decoder context list ctxlist. This issue can lead to a NULL pointer dereference in the vpudecipihandler function, resulting in a kernel panic. Mitigation Mitigation for this issu...

DEBIAN-CVE-2024-35920

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect decoder context list Add a lock for the ctxlist, to avoid accessing a NULL pointer within the 'vpudecipihandler' function when the ctxlist has been deleted due to an unexpected...

CVE-2024-35919

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect encoder context list Add a lock for the ctxlist, to avoid accessing a NULL pointer within the 'vpuencipihandler' function when the ctxlist has been deleted due to an unexpected...

CVE-2024-35920

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect decoder context list Add a lock for the ctxlist, to avoid accessing a NULL pointer within the 'vpudecipihandler' function when the ctxlist has been deleted due to an unexpected...

UBUNTU-CVE-2024-35920

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect decoder context list Add a lock for the ctxlist, to avoid accessing a NULL pointer within the 'vpudecipihandler' function when the ctxlist has been deleted due to an unexpected...

CVE-2024-35920 media: mediatek: vcodec: adding lock to protect decoder context list

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect decoder context list Add a lock for the ctxlist, to avoid accessing a NULL pointer within the 'vpudecipihandler' function when the ctxlist has been deleted due to an unexpected...

CVE-2024-35920 media: mediatek: vcodec: adding lock to protect decoder context list

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect decoder context list Add a lock for the ctxlist, to avoid accessing a NULL pointer within the 'vpudecipihandler' function when the ctxlist has been deleted due to an unexpected...

CVE-2024-35920

In CVE-2024-35920, a race/NULL-pointer risk was addressed in the Linux kernel’s media: mediatek vcodec path. The fix adds a lock to protect the ctx_list to prevent dereferencing a NULL ctx_list in vpu_dec_ipi_handler when the list was deleted due to SCP IP block behavior, preventing a kernel oops...

CVE-2024-35919

CVE-2024-35919: The Linux kernel vulnerability involves a race/NULL dereference in media: mediatek: vcodec code where vpu_enc_ipi_handler may access a deleted ctx_list, potentially leading to a NULL pointer dereference when SCP IP block behavior deletes the list. A lock was added to protect the e...

CVE-2024-35919 media: mediatek: vcodec: adding lock to protect encoder context list

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect encoder context list Add a lock for the ctxlist, to avoid accessing a NULL pointer within the 'vpuencipihandler' function when the ctxlist has been deleted due to an unexpected...

password management API prints sensitive information in log files (CVE-2024-29954)

A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log files. This could allow an authenticated user to view the server passwords for protocols such as scp and sftp. Detail. When the...

Moderate: podman security and bug fix update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: podman: golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in...

[SECURITY] Fedora 39 Update: curl-8.2.1-5.fc39

curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

[SECURITY] Fedora 40 Update: curl-8.6.0-8.fc40

curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Missing character encoding in progress display allows for spoofing of scp client output (CVE-2019-6109)

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server or Man-in-The-Middle attacker can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This...

Unable to access NetScaler via SSH. SSH daemon process not running or able to start.

Device not accessible via SSH. Admin GUI actions that require SSH i.e. Generate Tech Support Bundle, Ping, simulated CLI do not work, shows error ""errorcode":"2138","message":"Not authorized to execute this command","severity":"ERROR"" Unable to access device via SCP. sshd process not running an...

CLSA-2024-1711562558 curl: Fix of 3 CVEs

Moved tuxcare patches from 7.29.0-59.1.tuxcare.els2 - CVE-2023-38546: cookie: remove unnecessary struct fields - CVE-2022-27782: check additional TLS or SSH connection parameters that should have prohibited connection reuse - CVE-2023-27534: fix SFTP path '' resolving discrepancy - fix read off...

PT-2024-8417 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a NULL pointer dereference in the Linux kernel's vcodec component. This can occur when the ctx list is accessed within the vpu enc ipi handler function after it...

Cisco IOS XE Software Command Authorization Bypass (cisco-sa-aaascp-Tyj4fEJm)

According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability. - A vulnerability in the Authentication, Authorization, and Accounting AAA feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to bypass command...

Cisco IOS Software Command Authorization Bypass (cisco-sa-aaascp-Tyj4fEJm)

According to its self-reported version, Cisco IOS is affected by a vulnerability. - A vulnerability in the Authentication, Authorization, and Accounting AAA feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to bypass command authorization and co...