kernel security update

5.14.0-427.28.14.OL9 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

DEBIAN-CVE-2024-42230

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix scv instruction crash with kexec kexec on pseries disables AIL reloconexc, required for scv instruction support, before other CPUs have been shut down. This means they can execute scv instructions after AIL i...

AZL-47232 CVE-2024-42230 affecting package kernel for versions less than 6.6.43.1-7

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix scv instruction crash with kexec kexec on pseries disables AIL reloconexc, required for scv instruction support, before other CPUs have been shut down. This means they can execute scv instructions after AIL i...

DEBIAN-CVE-2024-42127

In the Linux kernel, the following vulnerability has been resolved: drm/lima: fix shared irq handling on driver remove lima uses a shared interrupt, so the interrupt handlers must be prepared to be called at any time. At driver removal time, the clocks are disabled early and the interrupts stay...

CVE-2024-42111 btrfs: always do the basic checks for btrfs_qgroup_inherit structure

In the Linux kernel, the following vulnerability has been resolved: btrfs: always do the basic checks for btrfsqgroupinherit structure BUG Syzbot reports the following regression detected by KASAN: BUG: KASAN: slab-out-of-bounds in btrfsqgroupinherit+0x42e/0x2e20 fs/btrfs/qgroup.c:3277 Read of si...

CVE-2024-42111 btrfs: always do the basic checks for btrfs_qgroup_inherit structure

In the Linux kernel, the following vulnerability has been resolved: btrfs: always do the basic checks for btrfsqgroupinherit structure BUG Syzbot reports the following regression detected by KASAN: BUG: KASAN: slab-out-of-bounds in btrfsqgroupinherit+0x42e/0x2e20 fs/btrfs/qgroup.c:3277 Read of si...

PT-2024-38179

Name of the Vulnerable Software and Affected Versions: SourceCodester School Log Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown function of the file /admin/ajax.php?action=login. The manipulation of the username argument leads to SQL...

PT-2024-28321

Name of the Vulnerable Software and Affected Versions chargeover redoc version 2.0.9-rc.69 Description The issue allows attackers to execute arbitrary code or cause a Denial of Service DoS and have other impacts via the mergeObjects function. Recommendations For chargeover redoc version...

PT-2024-38186 · Sourcecodester · Sourcecodester Medicine Tracker System

Name of the Vulnerable Software and Affected Versions: SourceCodester Medicine Tracker System version 1.0 Description: A vulnerability was found in the Password Change Handler component of the SourceCodester Medicine Tracker System, affecting the file /classes/Users.php?f=save user. The...

PT-2024-29403 · Hicolor · Hicolor

Name of the Vulnerable Software and Affected Versions: hicolor version 0.5.0 Description: A stack overflow in the cp dynamic function, located in /vendor/cute png.h, allows attackers to cause a Denial of Service DoS via a crafted PNG file. Recommendations: For hicolor version 0.5.0, consider...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an interrupt handler in the drm/lima module that must be ready to be called during driver removal. Since...

PT-2024-28322 · Ais · Ais-Ltd Strategyen

Name of the Vulnerable Software and Affected Versions: ais-ltd strategyen version 0.4.0 Description: The issue allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties using the mergeObjects function. This is a result of prototype pollution...

PT-2024-28320 · Snapstate · Snapstate

Name of the Vulnerable Software and Affected Versions: snapstate version 0.0.9 Description: The issue is related to a prototype pollution vulnerability via the attemptNestedProperty function. This allows attackers to execute arbitrary code or cause a Denial of Service DoS by injecting arbitrary...

PT-2024-5666 · Tenda · Tenda I22

Name of the Vulnerable Software and Affected Versions: Tenda i22 version 1.0.0.34687 Description: A critical issue was found in the formApPortalPhoneAuth function of the /goform/apPortalPhoneAuth file. The manipulation of the data argument leads to a buffer overflow. This can be exploited remotel...

DEBIAN-CVE-2024-41081

In the Linux kernel, the following vulnerability has been resolved: ila: block BH in ilaoutput As explained in commit 1378817486d6 "tipc: block BH before using dstcache", net/core/dstcache.c helpers need to be called with BH disabled. ilaoutput is called from lwtunneloutput possibly from process...

AZL-68343 CVE-2024-41082 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: nvme-fabrics: use reserved tag for reg read/write command In some scenarios, if too many commands are issued by nvme command in the same time by user tasks, this may exhaust all tags of adminq. If a reset nvme reset or IO timeout...

DEBIAN-CVE-2024-41078

In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix quota root leak after quota disable failure If during the quota disable we fail when cleaning the quota tree or when deleting the root from the root tree, we jump to the 'out' label without ever dropping the...

UBUNTU-CVE-2024-41078

In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix quota root leak after quota disable failure If during the quota disable we fail when cleaning the quota tree or when deleting the root from the root tree, we jump to the 'out' label without ever dropping the...

UBUNTU-CVE-2024-41082

In the Linux kernel, the following vulnerability has been resolved: nvme-fabrics: use reserved tag for reg read/write command In some scenarios, if too many commands are issued by nvme command in the same time by user tasks, this may exhaust all tags of adminq. If a reset nvme reset or IO timeout...

CVE-2024-41078 btrfs: qgroup: fix quota root leak after quota disable failure

In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix quota root leak after quota disable failure If during the quota disable we fail when cleaning the quota tree or when deleting the root from the root tree, we jump to the 'out' label without ever dropping the...