USN-7276-1: Linux kernel vulnerabilities

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service system crash or possibly execute arbitrary code...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: serial: max3100: Lock port-lock when calling uarthandlectschange The uarthandlectschange function must be called with the port locked. Since we execute it in a separate process, the lock might not be taken at the time of executio...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: PCI/DPC: Fixed a use-after-free issue when a DPC event occurs concurrently with hot-removal of the same portion of the hierarchy. Keith reported a use-after-free when a DPC event occurred concurrently with the hot-removal of t...

CVE-2021-35689

A potential vulnerability in the Oracle Talent Acquisition Cloud - Taleo Enterprise Edition. This high severity potential vulnerability allows attackers to perform remote code execution on Taleo Enterprise Edition system. Successful attacks of this vulnerability can result in unauthorized remote...

CVE-2024-57903

In the Linux kernel, the following vulnerability has been resolved: net: restrict SOREUSEPORT to inet sockets After blamed commit, crypto sockets could accidentally be destroyed from RCU call back, as spotted by zyzbot 1. Trying to acquire a mutex in RCU callback is not allowed. Restrict...

CVE-2024-57903

In the Linux kernel, the following vulnerability has been resolved: net: restrict SOREUSEPORT to inet sockets After blamed commit, crypto sockets could accidentally be destroyed from RCU call back, as spotted by zyzbot 1. Trying to acquire a mutex in RCU callback is not allowed. Restrict...

CVE-2024-43098

In the Linux kernel, the following vulnerability has been resolved: i3c: Use i3cdev-desc-info instead of calling i3cdevicegetinfo to avoid deadlock A deadlock may happen since the i3cmasterregister acquires &i3cbus-lock twice. See the log below. Use i3cdev-desc-info instead of calling i3cdevicein...

CVE-2024-53689

Removed by vendor...

PT-2026-4475

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the btrfs subsystem, specifically in the btrfs get or create delayed node function. A previous commit altered the order of operations, removing a...

NI DAQExpress 安全漏洞

NI DAQExpress National Instruments DAQExpress is an interactive application software from National Instruments NI Inc. It is used to quickly acquire, analyze, and present data from data acquisition devices. A security vulnerability exists in NI DAQExpress that stems from the inclusion of an...

WinPmem 安全漏洞

WinPmem is an open source physical memory acquisition tool from Velocidex. A security vulnerability exists in WinPmem version 4.1 and earlier versions that stems from improper validation of input...

CVE-2020-12492 Wifi information acquisition vulnerability in Framework Services

Improper handling of WiFi information by framework services can allow certain malicious applications to obtain sensitive information...

CVE-2020-12492 Wifi information acquisition vulnerability in Framework Services

Improper handling of WiFi information by framework services can allow certain malicious applications to obtain sensitive information...

Why Italy Sells So Much Spyware

Interesting analysis: Although much attention is given to sophisticated, zero-click spyware developed by companies like Israel’s NSO Group, the Italian spyware marketplace has been able to operate relatively under the radar by specializing in cheaper tools. According to an Italian Ministry of...

Malwarebytes acquires AzireVPN to fuel additional VPN features and functionalities

Today I have great news to share: We've acquired AzireVPN, a privacy-focused VPN provider based in Sweden. I wanted to share with you our intentions behind this exciting step, and what this means for our existing users and the family of solutions they rely on to keep them private and secure...

The vulnerability of the SCADA system MasterSCADA, related to deficiencies in password protection mechanisms, allows unauthorized access to the project by intruders.

The vulnerability of the SCADA system MasterSCADA is related to deficiencies in the password protection mechanism. Exploiting this vulnerability can allow an intruder to gain unauthorized access to the project...

7 Rapid Questions on our Belfast Placement Programme: Orla Magee and Paddy McDermott

Ever wonder what it’s like to be an intern at Rapid7 in Belfast? Software Engineers Orla Magee and Paddy McDermott share what the interview process looked like for them, along with impactful projects and advice for others exploring Rapid7’s Placement Programme. What was the interview process like...

AI-Powered Rhadamanthys Stealer Targets Crypto Wallets with Image Recognition

The threat actors behind the Rhadamanthys information stealer have added new advanced features to the malware, including using artificial intelligence AI for optical character recognition OCR as part of what's called "Seed Phrase Image Recognition." "This allows Rhadamanthys to extract...

Advantech ADAM-5630 Information Disclosure Vulnerability

Advantech ADAM-5630 is an edge intelligent data acquisition controller from Advantech, China. The Advantech ADAM-5630 suffers from an information disclosure vulnerability that is caused by a flaw in sharing user credentials in plain text. An attacker can exploit the vulnerability to obtain...

Advantech ADAM-5630 安全漏洞

Advantech ADAM-5630 is an edge intelligent data acquisition controller from Advantech, China. The Advantech ADAM-5630 suffers from an Access Control Error vulnerability that originates from an authenticated user's cookie being retained as a valid cookie even after the session is closed. An attack...