Reptile Rootkit: Advanced Linux Malware Targeting South Korean Systems

Threat actors are using an open-source rootkit called Reptile to target Linux systems in South Korea. "Unlike other rootkit malware that typically only provide concealment capabilities, Reptile goes a step further by offering a reverse shell, allowing threat actors to easily take control of...

Denial Of Service (DOS)

libbzip3.so is vulerable to Denial Of Service. The vulnerability is due to not setting zeroed temporary array while interacting with libsais in the function bz3new in file libbz3.c resulting in Denial Of Service attack...

Huawei EulerOS: Security Advisory for protobuf-c (EulerOS-SA-2023-2567)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for c-ares (EulerOS-SA-2023-2536)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the uClibC and uClibC-ng libraries used by Hirschmann EAGLE industrial network interfaces allows attackers to execute arbitrary code.

The vulnerability of the uClibC and uClibC-ng libraries used by Hirschmann EAGLE industrial network switches is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Huawei EulerOS: Security Advisory for c-ares (EulerOS-SA-2023-2555)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for protobuf-c (EulerOS-SA-2023-2548)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AlmaLinux 9 : nodejs (ALSA-2023:4331)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:4331 advisory. - The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request...

EulerOS Virtualization 2.10.0 : c-ares (EulerOS-SA-2023-2555)

According to the versions of the c-ares package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the...

EulerOS Virtualization 2.10.1 : c-ares (EulerOS-SA-2023-2536)

According to the versions of the c-ares package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the...

ngiflib Security Vulnerabilities

ngiflib is a library for decoding the GIF image format written in C. It has a vulnerability that stems from a segmentation error in the main method of the gif2tag.c file. A security vulnerability exists in ngiflib, which is caused by a segmentation error in the main method of the gif2tag.c file...

EulerOS Virtualization 2.10.0 : protobuf-c (EulerOS-SA-2023-2567)

According to the versions of the protobuf-c package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - protobuf-c before 1.4.1 has an unsigned integer overflow in parserequiredmember. CVE-2022-48468 Note that Tenable Network...

Oracle Linux 8 : mod_auth_openidc:2.3 (ELSA-2023-4418)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-4418 advisory. - CVE-2023-37464 cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE Resolves: rhbz2223308 modauthopenidc Tenab...

Summary: MTE As Implemented

By Mark Brand, Project Zero In mid-2022, Project Zero was provided with access to pre-production hardware implementing the ARM MTE specification. This blog post series is based on that review, and includes general conclusions about the effectiveness of MTE as implemented, specifically in the...

EulerOS Virtualization 2.10.1 : protobuf-c (EulerOS-SA-2023-2548)

According to the versions of the protobuf-c package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - protobuf-c before 1.4.1 has an unsigned integer overflow in parserequiredmember. CVE-2022-48468 Note that Tenable Network...

Huawei EulerOS: Security Advisory for protobuf-c (EulerOS-SA-2023-2529)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for protobuf-c (EulerOS-SA-2023-2516)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-35929 · Git +1 · Opensc

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read crash. The crash occurs in the test verify function within the fuzz pkcs11.c file. No information is...

GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow

The deprecated compatibility function clntcreate in the sunrpc module of the GNU C Library aka glibc through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or if an application is no...

CVE-2023-34358

ASUS RT-AX88U's httpd is subject to an unauthenticated DoS condition. A remote attacker can send a specially crafted request to a device which contains a specific user agent, causing the httpd binary to crash during a string comparison performed within web.c, resulting in a DoS condition...