SUSE CVE-2024-50141

In the Linux kernel, the following vulnerability has been resolved: ACPI: PRM: Find EFIMEMORYRUNTIME block for PRM handler and context PRMT needs to find the correct type of block to translate the PA-VA mapping for EFI runtime services. The issue arises because the PRMT is finding a block of type...

SUSE CVE-2024-50172

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Fix a possible memory leak In bnxtresetupchipctx when bnxtqplibmapdbbar fails driver is not freeing the memory allocated for "rdev-chipctx"...

Privilege Context Switching Error

Overview Duende.AccessTokenManagement.OpenIdConnect is a .NET library that manages OpenId Connect access tokens in ASP.NET Core applications. Affected versions of this package are vulnerable to Privilege Context Switching Error due to the improper handling of token refresh in pooled HttpClient...

firefox: thunderbird: Confusing display of origin for external protocol handler prompt

The Mozilla Foundation's Security Advisory: The origin of an external protocol handler prompt could be obscured using a data: URL within an iframe...

DEBIAN-CVE-2024-50172

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Fix a possible memory leak In bnxtresetupchipctx when bnxtqplibmapdbbar fails driver is not freeing the memory allocated for "rdev-chipctx"...

AZL-52989 CVE-2024-50172 affecting package kernel for versions less than 6.6.64.2-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Fix a possible memory leak In bnxtresetupchipctx when bnxtqplibmapdbbar fails driver is not freeing the memory allocated for "rdev-chipctx"...

CVE-2024-50140

In the Linux kernel, the following vulnerability has been resolved: sched/core: Disable page allocation in tasktickmmcid With KASAN and PREEMPTRT enabled, calling taskworkadd in tasktickmmcid may cause the following splat. 63.696416 BUG: sleeping function called from invalid context at...

UBUNTU-CVE-2024-50172

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Fix a possible memory leak In bnxtresetupchipctx when bnxtqplibmapdbbar fails driver is not freeing the memory allocated for "rdev-chipctx"...

CVE-2024-50172 RDMA/bnxt_re: Fix a possible memory leak

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Fix a possible memory leak In bnxtresetupchipctx when bnxtqplibmapdbbar fails driver is not freeing the memory allocated for "rdev-chipctx"...

The vulnerability of the `ff_v4l2_m2m_create_context` function in the `v4l2_m2m.c` component of the FFmpeg multimedia library occurs due to improper memory release before deleting the last reference. This allows a malicious actor to trigger a service failure.

The vulnerability of the ffv4l2m2mcreatecontext function in the v4l2m2m.c component of the FFmpeg multimedia library is related to improper memory release before deleting the last pointer. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

CVE-2024-51757 Fixes security vulnerability that allowed for server side code to be executed by a <script> tag

happy-dom is a JavaScript implementation of a web browser without its graphical user interface. Versions of happy-dom prior to 15.10.2 may execute code on the host via a script tag. This would execute code in the user context of happy-dom. Users are advised to upgrade to version 15.10.2. There ar...

CVE-2024-51757

CVE-2024-51757 affects the JavaScript library happy-dom (a headless browser implementation). Versions prior to 15.10.2 may execute code on the host via a script tag, running in the user context of happy-dom with high impact on confidentiality, integrity, and availability. The issue is triggered b...

CVE-2024-51757 Fixes security vulnerability that allowed for server side code to be executed by a <script> tag

happy-dom is a JavaScript implementation of a web browser without its graphical user interface. Versions of happy-dom prior to 15.10.2 may execute code on the host via a script tag. This would execute code in the user context of happy-dom. Users are advised to upgrade to version 15.10.2. There ar...

podman: Build Context Bind Mount

A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on the host, leaving the created files...

SUSE CVE-2024-50091

In the Linux kernel, the following vulnerability has been resolved: dm vdo: don't refer to dedupecontext after releasing it Clear the dedupecontext pointer in a datavio whenever ownership of the context is lost, so that vdo can't examine it accidentally...

SUSE CVE-2024-50094

In the Linux kernel, the following vulnerability has been resolved: sfc: Don't invoke xdpdoflush from netpoll. Yury reported a crash in the sfc driver originated from netpollsendudp. The netconsole sends a message and then netpoll invokes the driver's NAPI function with a budget of zero. It is...

SUSE CVE-2024-50101

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix incorrect pciforeachdmaalias for non-PCI devices Previously, the domaincontextclear function incorrectly called pciforeachdmaalias to set up context entries for non-PCI devices. This could lead to kernel hangs or...

SUSE CVE-2024-50111

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Enable IRQ if doale triggered in irq-enabled context Unaligned access exception can be triggered in irq-enabled context such as user mode, in this case doale may call getuser which may cause sleep. Then we will get: BU...

PT-2024-35555

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.65 Description A vulnerability in the Linux kernel has been resolved. The issue is related to the introduction of support for vsock and unix sockets in sockmap, where the function tls sw has ctx tx/rx cannot...

happy-dom 代码注入漏洞

happy-dom is a JavaScript implementation of a web browser without a graphical user interface by the individual developer David Ortner. A code injection vulnerability exists in happy-dom versions prior to 15.10.2, which originates from code execution on the host via script tags, leading to code...