CVE-2022-48785 ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcu-safe version of ipv6getlladdr Some time ago 8965779d2c0e "ipv6,mcast: always hold idev-lock before mcalock" switched ipv6getlladdr to ipv6getlladdr, which is rcu-unsafe version. That was OK, because idev-lock...

SUSE CVE-2024-40916

In the Linux kernel, the following vulnerability has been resolved: drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found When reading EDID fails and driver reports no modes available, the DRM core adds an artificial 1024x786 mode to the connector. Unfortunately some variant...

DEBIAN-CVE-2024-40916

In the Linux kernel, the following vulnerability has been resolved: drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found When reading EDID fails and driver reports no modes available, the DRM core adds an artificial 1024x786 mode to the connector. Unfortunately some variant...

CVE-2024-39508

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: Use setbit and testbit at worker-flags Utilize setbit and testbit on worker-flags within iouring/io-wq to address potential data races. The structure ioworker-flags may be accessed through various data paths, leadi...

UBUNTU-CVE-2024-40916

In the Linux kernel, the following vulnerability has been resolved: drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found When reading EDID fails and driver reports no modes available, the DRM core adds an artificial 1024x786 mode to the connector. Unfortunately some variant...

CVE-2024-40916

In the Linux kernel, the following vulnerability has been resolved: drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found When reading EDID fails and driver reports no modes available, the DRM core adds an artificial 1024x786 mode to the connector. Unfortunately some variant...

CLSA-2024-1720776957 vim: Fix of 10 CVEs

CVE-2023-0054: check the return value of vimregsub - CVE-2023-0049: avoid going over the NUL at the end - CVE-2023-0288: prevent the cursor from moving to line zero - CVE-2023-0433: check for not going over the end of the line - CVE-2023-2610: limit the text length to MAXCOL - CVE-2023-4750:...

CVE-2024-6409 Openssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9

A race condition vulnerability was discovered in how signals are handled by OpenSSH's server sshd. If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not...

OESA-2024-1798 rubygem-activesupport security update

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing. Security Fixes: A Cross-Site-Scripting vulnerability was found in rubygem ActiveSupport. If the new bytesplice method is...

UBUNTU-CVE-2024-38519

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to the fixed versions, yt-dlp and youtube-dl do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder and path traversal on Windows. Since yt-dlp and youtube-...

[ASA-202407-1] openssh: authentication bypass

Arch Linux Security Advisory ASA-202407-1 ========================================= Severity: High Date : 2024-07-01 CVE-ID : CVE-2024-6387 Package : openssh Type : authentication bypass Remote : Yes Link : https://security.archlinux.org/AVG-2855 Summary ======= The package openssh before version...

Rejected reason: We issued this CVE pre-maturely as we have subsequently realized that this issue points out a problem that there really is no safe measures around or protections for.

...

CVE-2024-38521 Persistent Cross-Site Scripting (XSS) in hushline inbox

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. The input is displayed using the safe Jinja2 attribute, and thus not sanitized upon display. This issue has been patched in version 0.1.0...

CVE-2024-37742

Insecure Access Control in Safe Exam Browser SEB = 3.5.0 on Windows. The vulnerability allows an attacker to share clipboard data between the SEB kiosk mode and the underlying system, compromising exam integrity. By exploiting this flaw, an attacker can bypass exam controls and gain an unfair...

UBUNTU-CVE-2024-37354

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix crash on racing fsync and size-extending write into prealloc We have been seeing crashes on duplicate keys in btrfssetitemkeysafe: BTRFS critical device vdb: slot 4 key 450 108 8192 new key 450 108 8192 ------------ cu...

Malicious code in activerecord-safe-initialize (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6474 Malicious code in activerecord-safe-initialize (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in new-tricks-v-bucks-generator-free_2023-safe-ahk (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2699 Malicious code in new-tricks-v-bucks-generator-free_2023-safe-ahk (npm)

--- -= Per source details. Do not edit below this line.=-...

Safe Exam Browser Security Vulnerability

Safe Exam Browser is a secure web browser environment organized by ETH Zurich, Switzerland. It allows secure online exams. A security vulnerability exists in Safe Exam Browser for Windows versions prior to 3.6. An attacker could exploit the vulnerability to share clipboard data between the SEB...