CVE-2024-43704

Software installed and run as a non-privileged user may conduct improper GPU system calls to gain access to the graphics buffers of a parent process...

CVE-2024-43704 GPU DDK - PowerVR: PVRSRVAcquireProcessHandleBase can cause psProcessHandleBase reuse when PIDs are reused

Software installed and run as a non-privileged user may conduct improper GPU system calls to gain access to the graphics buffers of a parent process...

CVE-2024-43704

CVE-2024-43704 affects Imagination Technologies PowerVR GPU driver. The PVRSRVAcquireProcessHandleBase() function can reuse psProcessHandleBase when PIDs are reused, allowing a non-privileged user to perform improper GPU system calls and access the graphics buffers of a parent process. This is a ...

PT-2024-30630 · Imagination Technologies · Powervr

Name of the Vulnerable Software and Affected Versions: PowerVR affected versions not specified Description: The issue allows software installed and run as a non-privileged user to conduct improper GPU system calls, potentially gaining access to the graphics buffers of a parent process. This is...

The vulnerability of the Fortinet FortiDeceptor system, which is used for detecting and responding to external and internal security threats, as well as the FortiSandbox system for threat detection and elimination, can be exploited due to improper privilege management. This allows attackers to execute unauthorized API calls.

The vulnerability of the Fortinet FortiDeceptor system, which is used for detecting and responding to external and internal security threats, is related to improper privilege management. Exploiting this vulnerability allows an attacker, operating locally, to execute unauthorized API calls using...

Schneider Electric Modicon M340 输入验证错误漏洞

The Schneider Electric Modicon M340 is a mid-range PLC Programmable Logic Controller for industrial processes and infrastructure from Schneider Electric France. An input validation error vulnerability exists in the Schneider Electric Modicon M340, which stems from the presence of an improper inpu...

Schneider Electric Modicon M340 缓冲区错误漏洞

The Schneider Electric Modicon M340 is a mid-range PLC Programmable Logic Controller for industrial processes and infrastructure from Schneider Electric France. The Schneider Electric Modicon M340 suffers from a buffer error vulnerability that originates from improperly constrained memory buffer...

Moderate: Red Hat Security Advisory: python3.9 security update

An update for python3.9 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

kernel: i915/perf: Fix NULL deref bugs with drm_dbg() calls

In the Linux kernel, the following vulnerability has been resolved: i915/perf: Fix NULL deref bugs with drmdbg calls When i915 perf interface is not available dereferencing it will lead to NULL dereferences. As returning -ENOTSUPP is pretty clear return when perf interface is not available...

Moderate: python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

Moderate: python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

CVE-2024-51992 Method Exposure Vulnerability in Modals in orchid/platform

Orchid is a @laravel package that allows for rapid application development of back-office applications, admin/user panels, and dashboards. This vulnerability is a method exposure issue CWE-749: Exposed Dangerous Method or Function in the Orchid Platform’s asynchronous modal functionality, affecti...

Ymir: new stealthy ransomware in the wild

Introduction In a recent incident response case, we discovered a new and notable ransomware family in active use by the attackers, which we named "Ymir". The artifact has interesting features, including a large set of operations performed in memory with the help of the malloc , memmove and memcmp...

RLSA-2024:8838 Moderate: python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

EulerOS 2.0 SP10 : unbound (EulerOS-SA-2024-2897)

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A heap-buffer-overflow flaw was found in the cfgmarkports function within Unbound's configfile.c, which can lead to memory corruption.This issue...

CVE-2024-36062

The com.callassistant.android aka AI Call Assistant & Screener application 1.174 for Android enables any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.callassistant.android.ui.call.incall.InCallActivity component...

CVE-2024-36064

The NLL com.nll.cb aka ACR Phone application through 0.330-playStore-NoAccessibility-arm8 for Android allows any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.nll.cb.dialer.dialer.DialerActivity component...

CVE-2024-36063

The Goodwy com.goodwy.dialer aka Right Dialer application through 5.1.0 for Android enables any application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.goodwy.dialer.activities.DialerActivity component...

PT-2024-26874 · Unknown · Com.Callassistant.Android

Name of the Vulnerable Software and Affected Versions: com.callassistant.android aka AI Call Assistant & Screener version 1.174 Description: The issue allows any installed application, even without permissions, to place phone calls without user interaction by sending a crafted intent via the...

CVE-2024-36062

The com.callassistant.android aka AI Call Assistant & Screener application 1.174 for Android enables any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.callassistant.android.ui.call.incall.InCallActivity component...