Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : GLib vulnerability (USN-7114-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7114-1 advisory. It was discovered that Glib incorrectly handled certain trailing characters. An attacker could possibly use this...

MAL-2024-10843 Malicious code in import-path-rewrite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 363c6630aff7d40a97f07e4d51dbc96358a4ff0a5365c7587cf6570e7005cf8d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10746 Malicious code in ovh_sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 92917852efa9507bfaba13452e5d975a00ace6cd986a5b5083ded3e3e8e898a6 The OpenSSF Package Analysis project identified 'ovhsentry' @ 100.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2024-0793 Kube-controller-manager: malformed hpa v1 manifest causes crash

A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn...

MAL-2024-10748 Malicious code in @fhnw/angular-app-configuration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 48cd6f8295f6741b9e52645ffbbb0792c303dc53b7371dbd456a13ea90d952a5 The OpenSSF Package Analysis project identified '@fhnw/angular-app-configuration' @ 1.0.4 npm as malicious. It is considered malicious because: ...

MAL-2024-10749 Malicious code in ffers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1366d070bf79e13bd91e0eba911fe052fba662a1a101ba6bc1e39872f3f00bae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-52616

A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs...

s2n-tls has undefined behavior at process exit

Impact s2n-tls uses the Linux atexit function to register functions that clean up the global state when the process exits. In multi-threaded environments, the atexit handler may clean up state which is still in use by other threads. When this occurs, the exiting process may experience a...

GHSA-RP9H-RF7G-HWGR s2n-tls has undefined behavior at process exit

Impact s2n-tls uses the Linux atexit function to register functions that clean up the global state when the process exits. In multi-threaded environments, the atexit handler may clean up state which is still in use by other threads. When this occurs, the exiting process may experience a...

webkitgtk: A malicious website may cause unexpected cross-origin behavior

A flaw was found in WebKit. This flaw allows a remote attacker to trigger unexpected cross-origin behavior via a malicious website...

ALSA-2024:9636 Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: Use after free in ANGLE CVE-2024-4558 webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash CVE-2024-40789 webkitgtk:...

Important: Red Hat Security Advisory: ACS 4.4 enhancement update

Updated images are now available for Red Hat Advanced Cluster Security RHACS. The updated image includes a bug fix and security fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

Malicious code in hodkasia01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9fb637e3836cd2591e09eb9f418dd4a919c7fae2c9ba94291565e186d6634e3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

`simd-json-derive` vulnerable to `MaybeUninit` misuse

An invalid use of MaybeUninit::uninit.assumeinit in simd-json-derive's derive macro can cause undefined behavior. The original code used MaybeUninit to avoid initialisation of the struct and then set the fields using ptr::write. The undefined behavior triggered by this misuse of MaybeUninit can...

`fast-float` has multiple soundness issues

fast-float contains multiple soundness issues: 1. Undefined behavior when checking input length, which has been merged but no package pubished. 1. Many functions marked as safe with non-local safety guarantees The library is also unmaintained. Alternatives For quickly parsing floating-point numbe...

LodaRAT: Established Malware, New Victim Patterns

Executive Summary Rapid7 has observed an ongoing malware campaign involving a new version of LodaRAT. This version possesses the ability to steal cookies and passwords from Microsoft Edge and Brave. LodaRAT, first observed in 2016, is a remote access tool RAT written in AutoIt. Development of...

kernel: nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells

In the Linux kernel, the following vulnerability has been resolved: nvmem: Fix shift-out-of-bound UBSAN with byte size cells If a cell has 'nbits' equal to a multiple of BITSPERBYTE the logic p &= GENMASKcell-nbits%BITSPERBYTE - 1, 0; will become undefined behavior because nbits modulo BITSPERBYT...

kernel: mptcp: really cope with fastopen race

A vulnerability was found in the subflowsimultaneousconnect function in the mptcp component in the Linux kernel, where not all possible subflow states are evaluated, leading to a potential race condition. This issue could lead to undefined network behavior...

kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors

In the Linux kernel, the following vulnerability has been resolved: usb: hub: Guard against accesses to uninitialized BOS descriptors Many functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h access fields inside udev-bos without checking if it was allocated and initialized. If...

kernel: drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga

In the Linux kernel, the following vulnerability has been resolved: drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga For pptable structs that use flexible array sizes, use flexible arrays...