CLSA-2022-1667493762 expat: Fix of CVE-2022-43680

CVE-2022-43680: Fix overeager DTD destruction...

expat: Fix of CVE-2022-43680

CVE-2022-43680: Fix overeager DTD destruction...

CLSA-2022-1667412749 Fix CVE(s): CVE-2022-43680

SECURITY UPDATE: Fix overeager DTD destruction - debian/patches/CVE-2022-43680: Fix heap use-after-free after overeager destruction of a shared DTD in function XMLExternalEntityParserCreate in out-of-memory situations - CVE-2022-43680...

CLSA-2022-1667412057 expat: Fix of CVE-2022-43680

CVE-2022-43680: Fix overeager DTD destruction...

GHSA-G23G-MW97-65C8 IBAX go-ibax vulnerable to SQL injection

SQL Injection vulnerability in /packages/api/database.go of go-ibax via where parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the databa...

In libexpat through 2.4.9 there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.

...

ZINC weaponizing open-source software

In recent months, Microsoft has detected a wide range of social engineering campaigns using weaponized legitimate open-source software by an actor we track as ZINC. Microsoft Threat Intelligence Center MSTIC observed activity targeting employees in organizations across multiple industries includi...

ZINC weaponizing open-source software

In recent months, Microsoft has detected a wide range of social engineering campaigns using weaponized legitimate open-source software by an actor we track as ZINC. Microsoft Threat Intelligence Center MSTIC observed activity targeting employees in organizations across multiple industries includi...

GSD-2022-1005739 Revert "md-raid: destroy the bitmap after destroying the thread"

Revert "md-raid: destroy the bitmap after destroying the thread" This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.140 by commit...

GSD-2022-1005676 md-raid: destroy the bitmap after destroying the thread

md-raid: destroy the bitmap after destroying the thread This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.61 by commit...

PT-2022-33934 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.61 Description: The issue concerns the md-raid component, where the bitmap is not properly destroyed after the thread is destroyed. This is an automated ID intended to aid in discovery of potential securit...

GSD-2022-1005350 md-raid: destroy the bitmap after destroying the thread

md-raid: destroy the bitmap after destroying the thread This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.2 by commit...

MilkyTracker 缓冲区错误漏洞

MilkyTracker is an application that plays MOD format files and arranges music. A security vulnerability exists in MilkyTracker v1.03.00, which originates when an attacker provides a crafted XM module file to the LoaderXM::load component, allowing the attacker to take control of the execution flow...

GSD-2022-1004816 net: tun: unlink NAPI from device on destruction

net: tun: unlink NAPI from device on destruction This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.251 by commit...

DEBIAN-CVE-2022-1145

Use after free in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific user interaction and profile destruction...

CVE-2022-1145

Use after free in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific user interaction and profile destruction...

CVE-2022-1145

Use after free in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific user interaction and profile destruction...

CVE-2022-1145

Use after free in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific user interaction and profile destruction...

CVE-2022-1145

Use after free in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific user interaction and profile destruction...

UBUNTU-CVE-2022-1145

Use after free in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific user interaction and profile destruction...