SUSE CVE-2024-1874

In PHP versions 8.1. before 8.1.28, 8.2. before 8.2.18, 8.3. before 8.3.5, when using procopen command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands ...

CVE-2024-36743

An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service DoS when an empty array is processed with oneflow.dot...

CVE-2024-36732

An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service DoS when an empty array is processed with oneflow.tensordot...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: fs/ntfs3: Use variable length arrays instead of fixed-size ones. The issue with the “smatch warning” should be fixed: Error in ntfssetlabel: builtinmemcpy’s ‘uni-name’ is too small 20 vs 256...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Fixed the issue of reading from a negative array index. Avoid using negative values for clkidex as an index into the array pptable-DpmDescriptor. V2: Fixed the return check for clkindex by Tim Huang...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Tracing: It was determined that processstring also allows arrays. To address a common bug where TRACEEVENT’s TPfastassign assigns the address of an allocated string to the ring buffer and then references it in TPPrintk, which can...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: For Wi-Fi-related modules, such as mwifiex: The issue of warning messages during memcpy operations that span multiple fields in mwifiexconfigscan has been fixed. To address this issue, replace the one-element array in the struct...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: The issue of protecting the fetch of -fdfd in dodup2 from mispredictions has been addressed. Both callers have ensured that fd is not greater than -maxfds; however, a misprediction might lead to the speculative execution of tofre...

Astra Linux – Vulnerability in dcmtk

There is an improper array index validation vulnerability in the determineMinMax functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead to an out-of-bounds write. An attacker can provide a malicious file to exploit this vulnerability...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Wifi: mwifiex: Fixed a warning regarding memcpy operations that span entire fields in mwifiexcmd80211scanext. This fix involves replacing a one-element array with a flexible-array member in the struct hostcmdds80211scanext...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Enforce hcall result buffer validity and size. Functions like plparhcall, plparhcall9, and related functions expect callers to provide valid result buffers of a certain minimum size. Currently, this is only...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bnx2x: Fixed multiple UBSAN array-index-out-of-bounds issues. Fixed UBSAN warnings that occur when using a system with 32 physical CPU cores or more, or when the user defines a number of Ethernet queues that is greater than or...

Astra Linux - Vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix out-of-bounds accesses to the SINF array The Panasonic laptop code uses the SINF array in various places with index values ranging from 0 to SINFCURBRIGHT0x0d without checking whether the SINF...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Platform/x86: toshibaacpi – Fixed array out-of-bounds access. In order to use toshibadmiquirks together with the standard DMI-related functions, it is necessary to end the list with an empty entry. Since this entry is missing, an...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drivers/perf: hisi: hns3: Fix for out-of-bound access when a valid event group is used. The perf tool allows users to create event groups using the cmd 1, but the driver does not check whether the array index is out of bounds whe...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ep93xx: clock: Fix for an offset of one in ep93xxdivrecalcrate. The psc-div array contains psc-numdiv elements. These values are derived from when we call clkhwregisterdiv. The size of these values is determined by...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Added an array index check for hdcp ddc access. Reason Coverity reported an OVERRUN warning. Do not check if the array index is valid. How Check that the msgid is valid and that the array index is valid...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf,perf: Fixed an invalid progarray access in perfeventdetachbpfprog Syzbot reported a crash that occurs in the following tracing scenario: - Create a tracepoint with attr.inherit=1, attach it to the process, and set the BPF...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: sched: schcake: Fixed the logic for accounting bulk flows in order to ensure host fairness. In schcake, we keep track of the number of active bulk flows per host. This is done when running in the dst/src host fairness mode, which...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: drm/amd/display: Check gpioid before using it as an array index. WHY & HOW The value “GPIOIDUNKNOWN -1” is not a valid value for an array index. Therefore, this value should be checked in advance. This fix resolves 5 OVERRUN...