SUSE SLES15: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2023:4035-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4035-1 advisory. The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes. The following security bugs were...

Fedora 38 : tracker-miners (2023-e8f45c67f5)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-e8f45c67f5 advisory. Seccomp jail improvements CVE-2023-43641 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

GLSA-202310-10 : libcue: Arbitrary Code Execution

The remote host is affected by the vulnerability described in GLSA-202310-10 libcue: Arbitrary Code Execution - libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment ca...

Slackware Linux 15.0 / current libcue Vulnerability (SSA:2023-283-01)

The version of libcue installed on the remote host is prior to 2.2.1. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-283-01 advisory. - libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds arr...

libcue -- out-of-bounds array access

The libcue team reports: There is a vulnerability to out-of-bounds array access...

Hewlett Packard Enterprise MSA Controller Environment Issue Vulnerability

The Hewlett Packard Enterprise MSA Controller HPE MSA Controller is a series of controllers from Hewlett Packard Enterprise USA. A security vulnerability exists in versions prior to Hewlett Packard Enterprise MSA Controller IN210R004, which stems from a vulnerability that allows an attacker to...

Existing pools will be bricked due to uninitialized state

Lines of code Vulnerability details Existing pools will be bricked due to uninitialized Summary Pools already present in the exchange will be bricked when crossTicks is called with an uninitialized tickTracking storage, which will trigger an array out of bounds error. Impact New pools in the...

Gas Limit Issues/DoS with Block Gas Limit

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Iterating through the users array without a limitation might cause the function to consume a lot of gas, especially when the array size is large. It may potentially reach the block gas limit and get...

Lack of Input Validation

Lines of code Vulnerability details Impact Neither function appears to validate the length of the users array, which opens the door for misuse or unexpected behavior. Proof of Concept A user can pass an empty array or an exceedingly large array to disrupt expected behavior. Tools Used Manual code...

Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerabilities (USN-6415-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6415-1 advisory. Daniel Trujillo, Johannes Wikner, and Kaveh Razavi discovered that some AMD processors utilising speculative execution and branch prediction may allow...

CVE-2023-24850 Improper Validation of Array Index in HLOS

Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application...

Updated java packages fix security vulnerabilities

The updated packages fix security vulnerabilities and a file conflict : Improper connection handling during TLS handshake. CVE-2023-21930 Incorrect enqueue of references in garbage collector. CVE-2023-21954 Certificate validation issue in TLS session negotiation. CVE-2023-21967 Swing HTML parsing...

PT-2023-22800 · Nodebb · Nodebb

Name of the Vulnerable Software and Affected Versions: NodeBB versions = 2.8.10 Description: The issue allows unauthenticated attackers to trigger a crash in NodeBB when invoking eventName.startsWith or eventName.toString, while processing Socket.IO messages via crafted Socket.IO messages...

CVE-2023-42753

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the h-nets array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local...

DEBIAN-CVE-2023-42753

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the h-nets array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local...

AZL-30050 CVE-2023-42753 affecting package kernel for versions less than 5.15.135.1-2

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the h-nets array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local...

Buffer overflow

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the h-nets array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local...

CVE-2023-42753

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the h-nets array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local...

CVE-2023-42753 Kernel: netfilter: potential slab-out-of-bound access due to integer underflow

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the h-nets array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local...

CVE-2023-42753

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the h-nets array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local...