PT-2024-13784 · Canonical · Lxd

Name of the Vulnerable Software and Affected Versions: LXD affected versions not specified Description: The issue is related to an insecure default setting that allows the UEFI Shell in EDK2, which was left enabled in LXD. This setting enables an OS-resident attacker to bypass Secure Boot...

GO-2024-2492 Panic in github.com/moby/buildkit

A malicious BuildKit client or frontend could craft a request that could lead to a BuildKit daemon crashing with a panic...

The vulnerability of the fgfmd daemon in the FortiOS operating system allows a hacker to execute arbitrary code.

The vulnerability of the fgfmd daemon in the FortiOS operating system is related to the use of uncontrolled format strings when processing binary files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted requests remotely...

[SECURITY] Fedora 39 Update: virtiofsd-1.10.1-1.fc39

Virtio-fs vhost-user device daemon Rust version...

Fedora: Security Advisory for rust-vhost-user-backend (FEDORA-2024-04877592b7)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6628-1 linux-intel-iotg vulnerabilities

Quentin Minster discovered that a race condition existed in the KSMBD implementation in the Linux kernel when handling sessions operations. A remote attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2023-32250, CVE-2023-32252, CVE-2023-32257...

CLSA-2024-1707420183 Fix CVE(s): CVE-2023-48795

SECURITY UPDATE: it's possible to remove the initial messages on the secure channel without causing a MAC failure - debian/patches/CVE-2023-48795.patch: implement "strict key exchange" in ssh and sshd - CVE-2023-48795...

CentOS 8 : dbus (CESA-2023:4498)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:4498 advisory. - D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the...

CentOS 8 : libreswan (CESA-2023:2122)

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:2122 advisory. - pluto in Libreswan before 4.11 allows a denial of service responder SPI mishandling and daemon crash via unauthenticated IKEv1 Aggressive Mode packets. The...

Fortinet Fortigate Format String Bug in fgfmd (FG-IR-24-029)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-029 advisory. - A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0...

SUSE CVE-2024-23650

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoi...

BuildKit Code Issues Vulnerabilities

BuildKit is a concurrent, cache-efficient, and Dockerfile-agnostic builder toolkit. A code issue vulnerability exists in BuildKit. An attacker could exploit this vulnerability to cause the BuildKit daemon to crash due to panic...

CVE-2024-23650

A vulnerability was found in the Moby Builder Toolkit. A malicious BuildKit client or any frontend that can craft a request could lead to the BuildKit daemon crashing with a panic due to the lack of input validation. A frontend is usually specified as the syntax line on a Dockerfile or with the...

GHSA-6FJ5-M822-RQX8 moby docker daemon crash during image pull of malicious image

Impact Pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Patches Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing. Credits Maintainers would like to thank Josh Larsen, Ian Coldwater, Duffie Cooley, Rory McCune for working on th...

moby docker daemon crash during image pull of malicious image

Impact Pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Patches Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing. Credits Maintainers would like to thank Josh Larsen, Ian Coldwater, Duffie Cooley, Rory McCune for working on th...

BuildKit vulnerable to possible panic when incorrect parameters sent from frontend

Impact A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. Patches The issue has been fixed in v0.12.5 Workarounds Avoid using BuildKit frontends from untrusted sources. A frontend image is usually specified as the syntax line on...

CVE-2024-23650

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoi...

AZL-35003 CVE-2024-23650 affecting package moby-engine for versions less than 25.0.3-1

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoi...

Design/Logic Flaw

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoi...

UBUNTU-CVE-2024-23650

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoi...