CVE-2022-4568

CVE-2022-4568 is described in the initial document as a directory permissions management vulnerability in Lenovo System Update that may allow elevation of privileges. The connected documents corroborate Lenovo-specific context and reference a Lenovo security advisory (LEN-103545) for remediation ...

CVE-2022-4568

A directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges...

CVE-2022-4568

A directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges...

PT-2023-14729 · Lenovo · Lenovo System Update

Name of the Vulnerable Software and Affected Versions: Lenovo System Update affected versions not specified Description: A directory permissions management issue may allow elevation of privileges. Recommendations: At the moment, there is no information about a newer version that contains a fix fo...

Lenovo System Update security vulnerabilities

Lenovo System Update is a simple, secure, automated system update program for Lenovo devices from Lenovo, a Chinese company. A security vulnerability exists in Lenovo System Update, which stems from a privilege management vulnerability...

CVE-2022-4568: Incorrect Default Permissions

A directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges...

USN-5891-1: curl vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Canonical Ubuntu 22.04 Description Harry Sintonen discovered that curl incorrectly handled HSTS support when multiple URLs are requested serially. A remote attacker could possibly use this issue to cause curl to use...

Security Bulletin: IBM QRadar Data Synchronization App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar Data Synchronization App for IBM QRadar SIEM has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-0235 DESCRIPTION: Node.js...

PT-2023-21462 · Apple · Macos Ventura +5

Name of the Vulnerable Software and Affected Versions: macOS Ventura versions prior to 13.3 iOS versions prior to 16.4 iPadOS versions prior to 16.4 iOS versions prior to 15.7.4 iPadOS versions prior to 15.7.4 tvOS versions prior to 16.4 watchOS versions prior to 9.4 Description: A use after free...

Low: vim

Issue Overview: Divide By Zero in GitHub repository vim/vim prior to 9.0.1367. CVE-2023-1127 Affected Packages: vim Issue Correction: Run dnf update vim --releasever 2023.0.20230322 or dnf update --advisory ALAS2023-2023-137 --releasever 2023.0.20230322 to update your system. More information on...

Important: sudo

Issue Overview: Sudo before 1.9.13p2 has a double free in the per-command chroot feature. CVE-2023-27320 Affected Packages: sudo Issue Correction: Run dnf update sudo --releasever 2023.0.20230322 or dnf update --advisory ALAS2023-2023-133 --releasever 2023.0.20230322 to update your system. More...

Important: cyrus-sasl

Issue Overview: A flaw was found in the SQL plugin shipped with Cyrus SASL. Failure to properly escape the SQL input allows a remote attacker to execute arbitrary SQL commands. This issue can lead to the escalation of privileges. CVE-2022-24407 Affected Packages: cyrus-sasl Issue Correction: Run...

Medium: flac

Issue Overview: An out-of-bounds write vulnerability was found in libFlak. The vulnerability occurs due to a missing bounds check. This flaw allows a local attacker without additional execution privileges to cause local information disclosure. CVE-2021-0561 Affected Packages: flac Issue Correctio...

Medium: python-jwt

Issue Overview: A vulnerability was found in python-jwt. This issue happens when PyJWT supports multiple different JWT signing algorithms. This flaw allows an attacker submitting the JWT token to choose the used signing algorithm, leading to key confusion through non-blocklisted public key format...

Important: python-werkzeug

Issue Overview: Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory ...

Important: gzip

Issue Overview: An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to...

Medium: ncurses

Issue Overview: The ncurses package tic is susceptible to a heap overflow on crafted input. When the terminfo entry-description compiler processes input, proper bounds checking was not enforced leading to this software flaw. The highest threat from this vulnerability is system availability...

Important: polkit

Issue Overview: A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling...

Medium: bind

Issue Overview: A cache poisoning vulnerability was found in BIND when using forwarders. Bogus NS records supplied by the forwarders may be cached and used by name if it needs to recurse for any reason. This issue causes it to obtain and pass on potentially incorrect answers. This flaw allows a...

Medium: libldb

Issue Overview: A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as...