CVE-2024-50092 net: netconsole: fix wrong warning

In the Linux kernel, the following vulnerability has been resolved: net: netconsole: fix wrong warning A warning is triggered when there is insufficient space in the buffer for userdata. However, this is not an issue since userdata will be sent in the next iteration. Current warning message:...

ffmpeg:ffmpeg_DEMUXER_fuzzer: Use-of-uninitialized-value in mxf_read_packet

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5824136942780416 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegDEMUXERfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

kernel: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers

A flaw was found in the Netfilter nftables subsystem of the Linux kernel. A local user can exploit this vulnerability due to improper validation when storing values into data registers, allowing internal chain object pointers to be exposed. This issue results in information disclosure, which can...

kernel: ELF: fix kernel.randomize_va_space double read

In the Linux kernel, the following vulnerability has been resolved: ELF: fix kernel.randomizevaspace double read ELF loader uses "randomizevaspace" twice. It is sysctl and can change at any moment, so 2 loads could see 2 different values in theory with unpredictable consequences. Issue exactly on...

kernel: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers

A flaw was found in the Netfilter nftables subsystem of the Linux kernel. A local user can exploit this vulnerability due to improper validation when storing values into data registers, allowing internal chain object pointers to be exposed. This issue results in information disclosure, which can...

kernel: ELF: fix kernel.randomize_va_space double read

In the Linux kernel, the following vulnerability has been resolved: ELF: fix kernel.randomizevaspace double read ELF loader uses "randomizevaspace" twice. It is sysctl and can change at any moment, so 2 loads could see 2 different values in theory with unpredictable consequences. Issue exactly on...

CVE-2024-47255: Improper Validation of Integrity Check Value

In 2N Access Commander versions 3.1.1.2 and prior, a local attacker can escalate their privileges in the system which could allow for arbitrary code execution with root permissions...

nimbus-jose-jwt: large JWE p2c header value causes Denial of Service

A vulnerability was found in the Nimbus Jose JWT package. By crafting a JWE with an excessively large p2c value, an attacker can trigger significant resource consumption during decryption, potentially leading to application slowdown or unavailability...

nimbus-jose-jwt: large JWE p2c header value causes Denial of Service

A vulnerability was found in the Nimbus Jose JWT package. By crafting a JWE with an excessively large p2c value, an attacker can trigger significant resource consumption during decryption, potentially leading to application slowdown or unavailability...

imagemagick:encoder_jxl_fuzzer: Use-of-uninitialized-value in GetPixelIntensity

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5162477567934464 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderjxlfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Cra...

SUSE SLES15 Security Update : rubygem-actionpack-5_1 (SUSE-SU-2024:3877-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3877-1 advisory. - CVE-2024-47887: Fixed Possible ReDoS vulnerability in HTTP Token authentication in Action Controller bsc1231729. - CVE-2024-42228: Fixed...

imagemagick:encoder_dng_fuzzer: Use-of-uninitialized-value in LibRaw::parse_kodak_ifd

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5142559472549888 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderdngfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Cra...

SUSE SLES12 Security Update : kernel (Live Patch 57 for SLE 12 SP5) (SUSE-SU-2024:3822-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3822-1 advisory. This update for the Linux Kernel 4.12.14-122219 fixes several issues. The following security issues were fixed: - CVE-2024-35863: Fixed potenti...

SUSE SLES15 Security Update : kernel (Live Patch 49 for SLE 15 SP2) (SUSE-SU-2024:3800-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3800-1 advisory. This update for the Linux Kernel 5.3.18-15020024194 fixes several issues. The following security issues were fixed: - CVE-2021-47600: dm btree...

SUSE SLES15 Security Update : kernel (Live Patch 27 for SLE 15 SP4) (SUSE-SU-2024:3780-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3780-1 advisory. This update for the Linux Kernel 5.14.21-15040024122 fixes several issues. The following security issues were fixed: - CVE-2021-47598: schcake:...

SUSE-SU-2024:3836-1 Security update for the Linux Kernel (Live Patch 28 for SLE 15 SP4)

This update for the Linux Kernel 5.14.21-15040024125 fixes several issues. The following security issues were fixed: - CVE-2021-47598: schcake: do not call cakedestroy from cakeinit bsc1227471. - Intermittent nfs mount failures may be due to SUNRPC over UDP bsc1231353 - CVE-2024-40954: net: do no...

CVE-2024-31151

A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds post-boot. Other vulnerabilities can force a reboot, circumventing the initial time restriction for exploitation.The password string can be...

open62541:fuzz_attributeoperand: Use-of-uninitialized-value in UA_String_escapeAppend

Project: https://github.com/open62541/open62541.git Detailed Report: https://oss-fuzz.com/testcase?key=4834543258894336 Project: open62541 Fuzzing Engine: libFuzzer Fuzz Target: fuzzattributeoperand Job Type: libfuzzermsanopen62541 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

SUSE CVE-2024-50069

In the Linux kernel, the following vulnerability has been resolved: pinctrl: apple: check devmkasprintf returned value devmkasprintf can return a NULL pointer on failure but this returned value is not checked. Fix this lack and check the returned value. Found by code review...

SUSE CVE-2024-50070

In the Linux kernel, the following vulnerability has been resolved: pinctrl: stm32: check devmkasprintf returned value devmkasprintf can return a NULL pointer on failure but this returned value is not checked. Fix this lack and check the returned value. Found by code review...