CVE-2024-35863 smb: client: fix potential UAF in is_valid_oplock_break()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in isvalidoplockbreak Skip sessions that are being teared down status == SESEXITING to avoid UAF...

sushi bug fix update

An update is available for sushi. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Sushi is a quick file previewer for Nautilus, the GNOME desktop file manager. I...

SUSE CVE-2024-26933

In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in port "disable" sysfs attribute The show and store callback routines for the "disable" sysfs attribute file in port.c acquire the device lock for the port's parent hub device. This can cause problems if...

DEBIAN-CVE-2024-26933

In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in port "disable" sysfs attribute The show and store callback routines for the "disable" sysfs attribute file in port.c acquire the device lock for the port's parent hub device. This can cause problems if...

AZL-42249 CVE-2024-26933 affecting package kernel for versions less than 5.15.160.1-1

In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in port "disable" sysfs attribute The show and store callback routines for the "disable" sysfs attribute file in port.c acquire the device lock for the port's parent hub device. This can cause problems if...

UBUNTU-CVE-2024-26933

In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in port "disable" sysfs attribute The show and store callback routines for the "disable" sysfs attribute file in port.c acquire the device lock for the port's parent hub device. This can cause problems if...

PT-2024-3842

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a potential use-after-free UAF in the smb2 is valid oplock break function. This function is part of the SMB client implementation in the Linux kernel. The...

PT-2024-3844

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a potential use-after-free UAF vulnerability in the is valid oplock break function of the Linux kernel's SMB client implementation. This vulnerability may allow a...

UBUNTU-CVE-2022-48630

In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - fix infinite loop on requests not multiple of WORDSZ The commit referenced in the Fixes tag removed the 'break' from the else branch in qcomrngread, causing an infinite loop whenever 'max' is not a multiple of...

DEBIAN-CVE-2023-52479

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix uaf in smb20oplockbreakack drop reference after use opinfo...

UBUNTU-CVE-2023-52479

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix uaf in smb20oplockbreakack drop reference after use opinfo...

[H1] Custom upgrade functionality is dangerous

Lines of code Vulnerability details Impact ​ Unsafe upgrade can break protocol Analysis of the vulnerability You are using a custom upgrade for the tokenomics contract not following UUPS standard function changeTokenomicsImplementationaddress implementation external // Check for the contract...

About the security content of watchOS 10.2

About the security content of watchOS 10.2 This document describes the security content of watchOS 10.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are availabl...

PT-2024-14723

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.0-rc7 Description A use-after-free vulnerability was found in the Linux kernel's SMB client, specifically in the smb2 query info compound function. This vulnerability was triggered when running fstests...

Memcached Security Vulnerabilities

Memcached is the United States Brad Fitzpatrick Brad Fitzpatrick individual developers of a high-performance distributed memory object caching system. The system reduces the number of database reads by caching data and objects in memory, thus increasing the speed of website access. A security...

CVE-2022-26942

The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment TEE modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure superviso...

PT-2024-14591 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A use-after-free uaf vulnerability has been resolved in the Linux kernel, specifically in the ksmbd module. The issue is related to the smb20 oplock break ack function, where a referen...

PT-2023-20520 · Crow · Crow

Name of the Vulnerable Software and Affected Versions: crow affected versions not specified Description: The issue concerns HTTP Response Splitting when untrusted user input is used to build header values. Header values are not properly sanitized against CRLF Injection in the set header and add...

Whitelisted profile creators could accidentally break migration for V1 profiles

Lines of code Vulnerability details Bug Description Profiles that exist before the V2 upgrade are migrated using the batchMigrateProfiles function, which works by minting the profile's handle and linking it to their profile: MigrationLib.solL69-L85 string memory handle =...

LACK OF VALIDATION CHECK COULD LEAD TO WRONG TOKEN TRANSFERS THUS BREAKING THE PROTOCOL

Lines of code Vulnerability details Impact The InterchainTokenService.processSendTokenWithDataPayload function is used to process the received token amount with data at the destination InterchainTokenService contract. The received token amount is transferred to either the expressCaller or the...