CVE-2024-53194 PCI: Fix use-after-free of slot->bus on hot remove

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix use-after-free of slot-bus on hot remove Dennis reports a boot crash on recent Lenovo laptops with a USB4 dock. Since commit 0fc70886569c "thunderbolt: Reset USB4 v2 host router" and commit 59a54c5f3dbd "thunderbolt: Res...

CLSA-2024-1735128527 Fix CVE(s): CVE-2024-50602

SECURITY UPDATE: Crash in XMLResumeParser function - debian/patches/CVE-2024-50602.patch: Refuse to stop/suspend an unstarted parser XMLERRORNOTSTARTED. Fix XMLStopParser to be explicit about XMLPARSING and handle default case. Cover XMLStopParser's new handling of status XMLINITIALIZED, Fix cras...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from accesses to hardware registers that could lead to endpoint crashes...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from accesses to hardware registers that could lead to endpoint crashes...

GHSA-WRW7-89JP-8Q8G Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter`

The VariantStrIter::implget function called internally by implementations of the Iterator and DoubleEndedIterator traits for this type was unsound, resulting in undefined behaviour. An immutable reference &p to a mut libc::cchar pointer initialized to NULL was passed as an argument to a C functio...

Monero: Remote memory exhaustion in Epee RPC stack under zero Receive Window

The Epee RPC stack in Monero was vulnerable to memory exhaustion attacks. Delayed ACK or zero Receive Window advertisements could cause the server to keep responses in the send queue until memory was exhausted. This could lead to remote crashes of Monero nodes that exposed their RPC interfaces...

autofs bug fix update

An update is available for autofs. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The autofs utility controls the operation of the automount daemon. The daemon...

CWA for Windows (2409) crashes or no sound when playing audio with Adaptive Audio disabled

When Adaptive Audio is disabled, the following errors may be encountered. CWA Windows session will suddenly crash when playing audio CWA Window session will not have any audio playback sound...

CVE-2024-53270 HTTP/1: sending overload crashes when the request is reset beforehand in envoy

Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions sendOverloadError is going to assume the active request exists when envoy.loadshedpoints.http1serverabortdispatch is configured. If activerequest is nullptr, only onMessageBeginImpl is called. However, the...

gstreamer1-plugins-good: OOB-write in convert_to_s334_1a

A flaw was found in the GStreamer library. An out-of-bounds write in the MP4/MOV demuxer when handling CEA608 Closed Caption tracks can lead to crashes for certain input files. This vulnerability allows a malicious third party to trigger a crash of the application and perform code execution throu...

Autodesk Navisworks 安全漏洞

Autodesk Navisworks is a 3D model review software for architecture, engineering and construction from Autodesk, Inc. in the United States. A security vulnerability exists in Autodesk Navisworks that originates from an out-of-bounds write that can be enforced when parsing a maliciously crafted DWF...

Autodesk Navisworks 缓冲区错误漏洞

Autodesk Navisworks is a 3D model review software for architecture, engineering, and construction from Autodesk, Inc. A buffer error vulnerability exists in Autodesk Navisworks, which originates from parsing a maliciously crafted DWF file can be used to cause a heap overflow, which can be exploit...

gstreamer1-plugins-base: out-of-bounds write in Ogg demuxer

A flaw was found in the GStreamer library. An out-of-bounds write in the Ogg demuxer can cause crashes for certain input files. This vulnerability allows a malicious third party to trigger out-of-bounds writes that can result in the application's crash or possibly allow code execution through hea...

gstreamer1-plugins-base: out-of-bounds write in Ogg demuxer

A flaw was found in the GStreamer library. An out-of-bounds write in the Ogg demuxer can cause crashes for certain input files. This vulnerability allows a malicious third party to trigger out-of-bounds writes that can result in the application's crash or possibly allow code execution through hea...

CBL Mariner 2.0 Security Update: docker-cli / moby-cli / moby-compose / moby-engine (CVE-2024-36623)

The version of docker-cli / moby-cli / moby-compose / moby-engine installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-36623 advisory. - moby through v25.0.3 has a Race Condition vulnerability in the...

USN-7157-2 php7.4 regression

USN-7157-1 fixed vulnerabilities in PHP. The patch for CVE-2024-8932 caused a regression in php7.4. This update fixes the problem. Original advisory details: It was discovered that PHP incorrectly handled certain inputs when processed with convert.quoted-printable decode filters. An attacker coul...

moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes.

...

ABB Cylon Aspect 3.08.02 (aspectMemory.php) Arbitrary Heap Memory Configuration

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description An authenticated access vulnerability in the aspectMemory.php script ...

PT-2024-36979

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue arises from the current implementation of the Linux kernel, where cache tags are removed after disabling ATS, leading to potential memory leaks and kernel crashes. Specifically...

CVE-2024-47599

A flaw was found in the GStreamer library. Insufficient error handling in the JPEG decoder can lead to NULL-pointer dereferences and cause crashes for certain input files, making it possible for a malicious actor to trigger a crash of the application...