Google Pixel Buffer Error Vulnerability

The Google Pixel is a smartphone from Google, Inc. A security vulnerability exists in Google Pixel, which stems from a missing bounds check in SignalStrengthAdapter::FillGsmSignalStrength of protocolmiscadapter.cpp, which may result in out-of-bounds reads...

PT-2023-30832 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to a possible out of bounds read in the SignalStrengthAdapter::FillGsmSignalStrength function of protocolmiscadapter.cpp. This is due to a missing bounds check, which...

postgresql: Role pg_signal_backend can signal certain superuser processes.

A flaw was found in PostgreSQL involving the pgcancelbackend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would...

USN-6538-1 postgresql-12, postgresql-14, postgresql-15 vulnerabilities

Jingzhou Fu discovered that PostgreSQL incorrectly handled certain unknown arguments in aggregate function calls. A remote attacker could possibly use this issue to obtain sensitive information. CVE-2023-5868 Pedro Gallegos discovered that PostgreSQL incorrectly handled modifying certain SQL arra...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that stems from post-release reuse in DSP services...

PT-2023-24172 · Qualcomm · Snapdragon +125

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves memory corruption in the Audio component when running an invalid audio recording from ADSP. No information is provided about the...

CVE-2023-49914

InteraXon Muse 2 devices allow remote attackers to cause a denial of service incorrect Muse App report of an outstanding, calm meditation state via a 480 MHz RF carrier that is modulated by a "false" brain wave, aka a Brain-Hack attack. For example, the Muse App does not display the reception of ...

postgresql: Role pg_signal_backend can signal certain superuser processes.

A flaw was found in PostgreSQL involving the pgcancelbackend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would...

postgresql: Role pg_signal_backend can signal certain superuser processes.

A flaw was found in PostgreSQL involving the pgcancelbackend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would...

postgresql: Role pg_signal_backend can signal certain superuser processes.

A flaw was found in PostgreSQL involving the pgcancelbackend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would...

SUSE-SU-2023:4612-1 Security update for java-1_8_0-openj9

This update for java-180-openj9 fixes the following issues: Update to OpenJDK 8u392 build 08 with OpenJ9 0.41.0 virtual machine - CVE-2023-22067: Fixed an IOR deserialization issue in CORBA bsc1216379. - CVE-2023-22081: Fixed a certificate path validation issue during client authentication...

Updated postgresql packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Memory disclosure in aggregate function calls. CVE-2023-5868 Buffer overrun from integer overflow in array modification. CVE-2023-5869 Role pgsignalbackend can signal certain superuser processes. CVE-2023-5870...

Node.js: Permissions can be bypassed via arbitrary code execution through abusing libuv signal pipes

Vulnerability description not provided...

A week in security (November 13 – November 19)

Last week on Malwarebytes Labs: Signal is testing usernames so you don’t have to share your phone number State of Maine data breach impacts 1.3 million people Credit card skimming on the rise for the holiday shopping season Update now! Microsoft patches 3 actively exploited zero-days Ransomware...

CVE-2023-5676

Eclipse OpenJ9 is vulnerable to a denial of service, caused by a flaw when a shutdown signal SIGTERM, SIGINT or SIGHUP is received before the JVM has finished initializing. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause an infinite...

SUSE CVE-2023-5676

In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or a segmentation fault if a shutdown signal SIGTERM, SIGINT or SIGHUP is received before the JVM has finished initializing...

IBM Java 7.1 < 7.1.5.20 / 8.0 < 8.0.8.15

The version of IBM Java installed on the remote host is prior to 7.1 7.1.5.20 / 8.0 8.0.8.15. It is, therefore, affected by a vulnerability as referenced in the IBM Security Update November 2023 advisory. - In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang ...

Running Signal Will Soon Cost $50 Million a Year

Signal’s president reveals the cost of running the privacy-preserving platform—not just to drum up donations, but to call out the for-profit surveillance business models it competes against...

Oracle Linux 9 : frr (ELSA-2023-6434)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6434 advisory. 8.3.1-11 - Resolves: RHEL-2263 - bgpd: Do not explicitly print MAXTTL value for ebgp-multihop vty output 8.3.1-10 - Related: 2216912 - adding sysadmin ...

The vulnerability of the PostgreSQL database management system lies in the ability to send signals to user processes through the role of pg_signal_backend. This allows a malicious actor to cause a service failure for a specific background process.

The vulnerability of the PostgreSQL database management system relates to the ability to send signals to user processes through the role of pgsignalbackend. Exploiting this vulnerability allows a malicious actor to cause a service failure for a specific background process...