Mozilla Firefox Security Advisory (MFSA2022-16) - Windows

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

[SECURITY] Fedora 36 Update: golang-github-containerd-continuity-0.2.2-3.fc36

A transport-agnostic, filesystem metadata manifest system...

curl: TLS and SSH connection too eager reuse

A vulnerability was found in curl. This issue occurs because curl can reuse a previously created connection even when a TLS or SSH-related option is changed that should have prohibited reuse. This flaw leads to an authentication bypass, either by mistake or by a malicious actor...

GSD-2022-1003851 ip_gre: test csum_start instead of transport header

ipgre: test csumstart instead of transport header This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.247 by commit...

CVE-2022-28166

In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8, the implementation of TLS/SSL Server Supports the Use of Static Key Ciphers ssl-static-key-ciphers on ports 443 & 18082...

The vulnerability of the CLS_PK_KeyGenMT() function in the Rambus SafeZone basic crypto module allows a hacker to calculate private RSA keys from a public key of a TLS certificate.

The vulnerability of the CLSPKKeyGenMT function in the Rambus SafeZone base crypto module is related to the use of insufficiently random values. Exploiting this vulnerability could allow an attacker, operating remotely, to calculate secret RSA keys from the public key of a TLS certificate...

The vulnerability of the TLS/SSL Server software component for network management in Brocade SANnav allows attackers to enhance their privileges.

The vulnerability of the TLS/SSL Server software component for managing SAN networks in Brocade SANnav systems is related to the presence of static encryption keys on ports 443 and 18082. Exploiting this vulnerability could allow a malicious actor to increase their privileges...

June 23, 2022—KB5014665 (OS Build 20348.803) Preview

None None...

Malicious code in spotify-transport (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f8e24e04ec9c9fa1918b8a0fe048dd7a7a8224e0f65a576271d007153e5b99f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6262 Malicious code in spotify-transport (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f8e24e04ec9c9fa1918b8a0fe048dd7a7a8224e0f65a576271d007153e5b99f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-32156

In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface CLI did not validate TLS certificates while connecting to a remote Splunk platform instance by default. After updating to version 9.0, see Configure TLS host name validation for the Splunk CLI...

CVE-2022-20155

In ipucorejqsmsgtransportkernelwritesync of ipu-core-jqs-msg-transport.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

Race condition

In ipucorejqsmsgtransportkernelwritesync of ipu-core-jqs-msg-transport.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

Splunk 信任管理问题漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

Splunk 信任管理问题漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

CVE-2022-32557

An issue was discovered in Couchbase Server before 7.0.4. The Index Service does not enforce authentication for TCP/TLS servers...

Using its HSTS support curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.

...

Couchbase Server 访问控制错误漏洞

Couchbase Server is a distributed, open source NoSQL non-relational database from Couchbase, Inc. that supports data querying, full-text searching, and active global replication. A security vulnerability exists in Couchbase Server versions prior to 7.0.4, which stems from the indexing service not...

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However several TLS andSSH settings were left out from the configuration match checks making themmatch too easily.

...

RLSA-2022:4899 Important: compat-openssl11 security and bug fix update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. compat-openssl11 provides the legacy 1.1 version of OpenSSL for use with older binaries. Security Fixes: openssl: Infinite...