DEBIAN-CVE-2023-35992

An integer overflow vulnerability exists in the FST fstReaderIterBlocks2 vesc allocation functionality of GTKWave 3.3.115, when compiled as a 32-bit binary. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability...

UBUNTU-CVE-2023-35992

An integer overflow vulnerability exists in the FST fstReaderIterBlocks2 vesc allocation functionality of GTKWave 3.3.115, when compiled as a 32-bit binary. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability...

CVE-2023-51277

nbviewer-app aka Jupyter Notebook Viewer before 0.1.6 has the get-task-allow entitlement for release builds...

Design/Logic Flaw

nbviewer-app aka Jupyter Notebook Viewer before 0.1.6 has the get-task-allow entitlement for release builds...

CVE-2023-51277

nbviewer-app aka Jupyter Notebook Viewer before 0.1.6 has the get-task-allow entitlement for release builds...

CVE-2023-4466

A vulnerability has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Web Interface. The manipulation leads to protection mechanism failure. The attack can be launched remotely. Th...

CVE-2023-4466

CVE-2023-4466 affects Poly CCX 400/600, Trio 8800/C60 Web Interface. The vulnerability in the Web Interface enables remote manipulation that causes protection mechanism failure. No explicit patch is provided; remediation involves removing vulnerable builds from public servers. Exploit has been di...

Buildkite Elastic CI for AWS time-of-check-time-of-use race condition vulnerability

A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to bypass a symbolic link check for the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script...

CVE-2023-43741

A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to bypass a symbolic link check for the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script...

CVE-2023-43741

CVE-2023-43741 describes a TOCTOU race in Buildkite Elastic CI for AWS. Versions prior to 6.7.1 and 5.22.5 allow the buildkite-agent user to bypass a symbolic link check for the PIPELINE_PATH variable in the script fix-buildkite-agent-builds-permissions. Red Hat and OSV entries confirm this vulne...

CVE-2023-43741

A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to bypass a symbolic link check for the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script...

PT-2023-28701 · Buildkit · Buildkite Elastic Ci For Aws

Name of the Vulnerable Software and Affected Versions: Buildkite Elastic CI for AWS versions prior to 6.7.1 Buildkite Elastic CI for AWS versions prior to 5.22.5 Description: A symbolic link following issue allows the buildkite-agent user to change ownership of arbitrary directories via the...

PT-2023-31781 · Unknown · Nbviewer-App

Name of the Vulnerable Software and Affected Versions: nbviewer-app aka Jupyter Notebook Viewer versions prior to 0.1.6 Description: The issue is related to the get-task-allow entitlement for release builds, which can lead to code execution due to an improperly set entitlement. The developer has...

CVE-2023-43116

Buildkite Elastic CI for AWS is affected by a symbolic link following vulnerability in versions prior to 6.7.1 and 5.22.5. The issue lets the buildkite-agent user change ownership of arbitrary directories via the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script. Affecte...

Security Bulletin: IBM® Db2® is affected by multiple vulnerabilities in the open source zlib library.

Summary IBM® Db2® is affected by multiple vulnerabilities in the open source zlib library. Vulnerability Details CVEID:CVE-2018-25032 DESCRIPTION: Zlib is vulnerable to a denial of service, caused by a memory corruption in the deflate operation. By using many distant matches, a remote attacker...

Security Bulletin: IBM® Db2® is vulnerable to denial of service under extreme stress conditions. (CVE-2023-40692)

Summary IBM® Db2® is vulnerable to denial of service under extreme stress conditions. Vulnerability Details CVEID:CVE-2023-40692 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to denial of service under extreme stress conditions. CVSS Base score: 5.9 CV...

ALPINE-CVE-2023-50268

jq is a command-line JSON processor. Version 1.7 is vulnerable to stack-based buffer overflow in builds using decNumber. Version 1.7.1 contains a patch for this issue...

jq Security Vulnerabilities

jq is jqlang open source a lightweight and flexible command-line JSON processor . A security vulnerability exists in jq version 1.7 that stems from the use of decNumber builds vulnerable to stack-based buffer overflows...

December 12, 2023—KB5033375 (OS Builds 22621.2861 and 22631.2861)

None None...

Race Condition (Leaky Vessels)

Overview Affected versions of this package are vulnerable to Race Condition Leaky Vessels in the subpath mounting when two malicious build steps are running in parallel and sharing the same cache mounts. This can lead to files from the host system being accessible to the build container. Workarou...