Policy data may be lost when a CVAD site is upgraded from an older version to 2311 or 2402

Citrix group policies may fail to appear in Studio post upgrade to CVAD Versions 2311 or 2402, and on Citrix DaaS. VDAs that expect the missing policies to be applied may behave differently...

PT-2024-5437

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the crypto starfive module in the Linux kernel, where a variable length buffer allocated in the software stack for RSA text data is freed, causing undefined...

CVE-2024-32761

Under certain conditions, a data leak may occur in the Traffic Management Microkernels TMMs of BIG-IP tenants running on VELOS and rSeries platforms. This leak occurs randomly and cannot be deliberately triggered. If it occurs, it may leak up to 64 bytes of non-contiguous randomized bytes. Under...

Oracle Linux 9 : gnutls (ELSA-2024-2570)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2570 advisory. 3.8.3-4 - Bump release to ensure el9 package is greater than el9 packages 3.8.3-3 - Bump release to ensure el9 package is greater than el9 packages...

PT-2024-28063

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.9.0-rc6+ Description A vulnerability in the Linux kernel has been resolved, specifically in the bnxt re module. The issue is related to undefined behavior when the bnxt qplib alloc init hwq function is called...

CVE-2024-34397

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based...

MAL-2024-1331 Malicious code in roblox.lua (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e40a28a758bd57252f74153dd5b2a9b6358608bfa2ec08c301e3647a7721e35a The OpenSSF Package Analysis project identified 'roblox.lua' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Ruijie Networks RG-UAC security vulnerability

Ruijie Networks RG-UAC is an Internet behavior management and auditing product from China's Ruijie Networks Ruijie Networks. It is used to solve Internet auditing problems. A security vulnerability exists in Ruijie Networks RG-UAC 20240428 and earlier versions, which stems from the parameter...

MAL-2024-1323 Malicious code in @socialdeal/uikit-whitelabel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d53c0749d21786a6b7eeea319c37d26573f1ded671dc9cbed9e4508d9b65a2c0 The OpenSSF Package Analysis project identified '@socialdeal/uikit-whitelabel' @ 999.100.1 npm as malicious. It is considered malicious because:...

MAL-2024-1330 Malicious code in elk-uikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis aaece47ca73a2646b0cb728b7816026ec3135f48e18054950dce89f8bf9073b0 The OpenSSF Package Analysis project identified 'elk-uikit' @ 99.99.1 npm as malicious. It is considered malicious because: - The package execut...

Medium: gnutls

Issue Overview: A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLSPRIVKEYFLAGREPRODUCIBLE flag, it can result in a noticeab...

CVE-2024-27069

In the Linux kernel, the following vulnerability has been resolved: ovl: relax WARNON in ovlverifyarea syzbot hit an assertion in copy up data loop which looks like it is the result of a lower file whose size is being changed underneath overlayfs. This type of use case is documented to cause...

CVE-2024-27069

In the Linux kernel, the following vulnerability has been resolved: ovl: relax WARNON in ovlverifyarea syzbot hit an assertion in copy up data loop which looks like it is the result of a lower file whose size is being changed underneath overlayfs. This type of use case is documented to cause...

CVE-2024-27069

CVE-2024-27069 affects the Linux kernel overlayfs ovl_verify_area path. The issue was a WARN_ON assertion triggered by syzbot’s copy-up loop when a lower file’s size changes underneath overlayfs. The documented fix relaxes the WARN_ON in ovl_verify_area and aligns error handling (returning EIO fo...

CVE-2024-26963 usb: dwc3-am62: fix module unload/reload behavior

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3-am62: fix module unload/reload behavior As runtime PM is enabled, the module can be runtime suspended when .remove is called. Do a pmruntimegetsync to make sure module is active before doing any register operations. Doi...

CVE-2024-27069: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ovl: relax WARNON in ovlverifyarea syzbot hit an assertion in copy up data loop which looks like it is the result of a lower file whose size is being changed underneath overlayfs. This type of use case is documented to cause...

webkitgtk: A malicious website may cause unexpected cross-origin behavior

A flaw was found in WebKit. This flaw allows a remote attacker to trigger unexpected cross-origin behavior via a malicious website...

MAL-2024-1308 Malicious code in not-exist-lykos-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7a4ae62646ef95a3157dcd61e8c0f58a25bec2c826d45f514c6e7bffde0126d4 The OpenSSF Package Analysis project identified 'not-exist-lykos-poc' @ 66.6.6 npm as malicious. It is considered malicious because: - The packa...

vyper performs incorrect topic logging in raw_log

Summary Incorrect values can be logged when rawlog builtin is called with memory or storage arguments to be used as topics. A contract search was performed and no vulnerable contracts were found in production. In particular, no uses of rawlog were found at all in production; it is apparently not ...

CLSA-2024-1714065005 Fix of 9 CVEs

CVE-url: https://ubuntu.com/security/CVE-2023-1998 - x86/speculation: Allow enabling STIBP with legacy IBRS CVE-url: https://ubuntu.com/security/CVE-2021-47193 - scsi: pm80xx: Tie the interrupt name to the module instance - scsi: pm80xx: Deal with kexec reboots - scsi: pm80xx: Increase number of...