CVE-2024-41044

In the Linux kernel, the following vulnerability has been resolved: ppp: reject claimed-as-LCP but actually malformed packets Since 'pppasyncencode' assumes valid LCP packets with code from 1 to 7 inclusive, add 'pppcheckpacket' to ensure that LCP packet has an actual body beyond PPPLCP header...

CVE-2024-41078

In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix quota root leak after quota disable failure If during the quota disable we fail when cleaning the quota tree or when deleting the root from the root tree, we jump to the 'out' label without ever dropping the...

CVE-2024-41079

In the Linux kernel, the following vulnerability has been resolved: nvmet: always initialize cqe.result The spec doesn't mandate that the first two double words aka results for the command queue entry need to be set to 0 when they are not used not specified. Though, the target implemention return...

CVE-2024-41040

In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix UAF when resolving a clash KASAN reports the following UAF: BUG: KASAN: slab-use-after-free in tcfctflowtableprocessconn+0x12b/0x380 actct Read of size 1 at addr ffff888c07603600 by task handler130/6469 Call Trace:...

CVE-2024-38517 affecting package rapidjson for versions less than 1.1.0-8

CVE-2024-38517 affecting package rapidjson for versions less than 1.1.0-8. A patched version of the package is available...

CVE-2023-45803 affecting package python-urllib3 for versions less than 2.0.7-1

CVE-2023-45803 affecting package python-urllib3 for versions less than 2.0.7-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-27318 affecting package pytorch for versions less than 2.2.2-1

CVE-2024-27318 affecting package pytorch for versions less than 2.2.2-1. A patched version of the package is available...

CVE-2024-39481 affecting package kernel for versions less than 6.6.35.1-5

CVE-2024-39481 affecting package kernel for versions less than 6.6.35.1-5. An upgraded version of the package is available that resolves this issue...

CVE-2024-35955 affecting package kernel for versions less than 6.6.28.1-1

CVE-2024-35955 affecting package kernel for versions less than 6.6.28.1-1. A patched version of the package is available...

CVE-2022-48670 affecting package kernel for versions less than 5.15.158.2-1

CVE-2022-48670 affecting package kernel for versions less than 5.15.158.2-1. A patched version of the package is available...

CVE-2024-5154

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal “../“. This flaw allows the container to read and write to arbitrary files on the host system...

Updated djvulibre packages fix security vulnerabilities

An issue was discovered IW44Image.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix RELEASELOCKOWNER CVE-2024-26629 In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: disallow anonymous set with timeout flag CVE-2024-26642 In the Linux kernel, the...

CVE-2024-35897

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: discard table flag update with pending basechain deletion Hook unregistration is deferred to the commit phase, same occurs with hook updates triggered by the table dormant flag. When both commands are combine...

CVE-2023-48727

NULL pointer dereference in some IntelR oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable information disclosure via local access...

CVE-2023-50230

BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must...

SUSE CVE-2023-21966

unknown...

SUSE CVE-2023-22005

unknown...

SUSE CVE-2023-22064

unknown...

CVE-2024-27322

Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not including 4.4.0, enabling a maliciously crafted RDS R Data Serialization formatted file or R package to run arbitrary code on an end user’s system when interacted...