CVE-2021-22326

A component of the HarmonyOS has a Privilege Dropping / Lowering Errors vulnerability. Local attackers may exploit this vulnerability to obtain Kernel space read/write capability...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS A vulnerability exists in the debug function code in the selinux module of some Huawei products that allows the user state to have the abili...

An EPYC escape: Case-study of a KVM breakout

Posted by Felix Wilhelm, Project Zero Introduction KVM for Kernel-based Virtual Machine is the de-facto standard hypervisor for Linux-based cloud environments. Outside of Azure, almost all large-scale cloud and hosting providers are running on top of KVM, turning it into one of the fundamental...

Virtuozzo ReadyKernel patch 129.0 for Virtuozzo Hybrid Server 7.0, 7.5 and Virtuozzo Hybrid Infrastructure 3.5, 4.0, 4.5, 4.6

The cumulative Virtuozzo ReadyKernel patch was updated with stability fixes. The patch applies to all supported kernels of Virtuozzo Hybrid Server 7 and Virtuozzo Hybrid Infrastructure. Vulnerability id: PSBM-130317 3.10.0-1062.4.2.vz7.116.7 to 3.10.0-1127.18.2.vz7.163.46 e2fsck considered the fi...

[SECURITY] Fedora 34 Update: nettle-3.7.3-1.fc34

Nettle is a cryptographic library that is designed to fit easily in more or less any context: In crypto toolkits for object-oriented languages C++, Python, Pike, ..., in applications like LSH or GNUPG, or even in kernel space...

Vulnerabilities fixed in IBM Spectrum Protect

IBM has fixed vulnerabilities in IBM Spectrum Protect Backup Archive Client and IBM Spectrum Protect for Space Management. A local malicious party could potentially exploit the vulnerabilities to cause a denial-of-service or to execute under elevated privileges execute arbitrary code. IBM has...

klibc input validation error vulnerability (CNVD-2021-54000)

klibc is an application program. Provides the ability to work from kernel space as early as possible. klibc versions prior to 2.0.9 are vulnerable to an input validation error, which stems from multiple possible integer overflows in the cpio command on 32-bit systems that could lead to buffer...

Command Execution Vulnerability in Zero Degrees of Space at Jiangyin Leader Information Technology Co.

Jiangyin Leader Information Technology Co., Ltd. was founded in 2006 by visiting scholars from the University of Copenhagen, Denmark, is a high-tech enterprise specializing in the development of application management software and Internet application technology development. Jiangyin City Leader...

CVE-2021-1905

creationtimestamp| type| source ---|---|--- 2021-06-08 17:52:38+00:00| seen| https://t.me/androidMalware/1217 2021-11-08 08:58:19+00:00| seen| MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422 2021-11-20 09:53:52+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2022-04-27 11:03:23+00:00| exploited|...

PT-2024-11169

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A bug has been fixed in the Linux kernel's ext4 file system, specifically in the ext4 es cache extent function, which is called by ext4 split extent at. The issue occurs when running...

Friday Squid Blogging: Squids in Space

NASA is sending baby bobtail squid into space. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...

Fedora: Security Advisory for glibc (FEDORA-2021-2ba993d6c5)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Schneider Electric homeLYnk和spaceLYnk 加密问题漏洞

Schneider Electric homeLYnk and spaceLYnk are both automation programming software for different logic controllers from Schneider Electric, France. An unauthorized access vulnerability exists in Schneider Electric homeLYnk and spaceLYnk, which arises from the presence of a broken or dangerous...

Virtuozzo Hybrid Infrastructure 4.5 Update 1 Hotfix 3 (4.5.1-42)

This update provides fixes for the storage and compute services. Vulnerability id: VSTOR-43250 Load balancer members are not displayed in the self-service panel. Vulnerability id: VSTOR-43236 A Kubernetes VM's system disk may be out of space due to Podman logs. Vulnerability id: VSTOR-41499...

Reddit: No rate limit leads to spaming post

Vulnerability description not provided...

[SECURITY] Fedora 33 Update: glibc-2.32-6.fc33

The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make upgrading easier, common system code is kept in one place and shared between programs. This particular package contains the most important se...

GHSA-V52P-HFJF-WG88 Division by zero in TFLite's implementation of `SpaceToBatchNd`

Impact The implementation of the SpaceToBatchNd TFLite operator is vulnerable to a division by zero error: cc TFLITEENSUREEQcontext, finaldimsize % blockshapedim, 0; outputsize-datadim + 1 = finaldimsize / blockshapedim; An attacker can craft a model such that one dimension of the block input is ...

GHSA-VF94-36G5-69V8 Division by zero in TFLite's implementation of `DepthToSpace`

Impact The implementation of the DepthToSpace TFLite operator is vulnerable to a division by zero error: cc const int blocksize = params-blocksize; ... const int inputchannels = input-dims-data3; ... int outputchannels = inputchannels / blocksize / blocksize; An attacker can craft a model such th...

GHSA-CFX7-2XPC-8W4H Division by zero in TFLite's implementation of `BatchToSpaceNd`

Impact The implementation of the BatchToSpaceNd TFLite operator is vulnerable to a division by zero error: cc TFLITEENSUREEQcontext, outputbatchsize % blockshapedim, 0; outputbatchsize = outputbatchsize / blockshapedim; An attacker can craft a model such that one dimension of the block input is 0...

libX11 Insufficient Length Check / Injection

Hello list, A missing length check in libX11 causes data from LookupColor requests mess up the client-server communication protocol and inject malicious X server requests. The flaw is comparable to SQLi injecting commands into database connections granting an attacker access to all features of th...