Security Bulletin: Vulnerability in Elasticsearch affects IBM Cloud Private (CVE-2021-22135, CVE-2021-22137)

Summary There is a vulnerability in the Elasticsearch open source library. The library is used by IBM Cloud Private logging. This bulletin identifies the security fixes to apply to address the Elasticsearch vulnerability CVE-2021-22135, CVE-2021-22137. Vulnerability Details CVEID: CVE-2021-22135...

Backdoor.Win32.SilentSpy.10 Authentication Bypass / Command Execution

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/a7ce38e60cf08f2b234f34043b87e701.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.SilentSpy.10 Vulnerability: Authentication Bypass Command Execution Description: The...

GSD-2021-1002845 hamradio: defer ax25 kfree after unregister_netdev

hamradio: defer ax25 kfree after unregisternetdev This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.12 by commit...

GSD-2021-1002843 phonet/pep: refuse to enable an unbound pipe

phonet/pep: refuse to enable an unbound pipe This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.12 by commit...

GSD-2021-1002840 mm, hwpoison: fix condition in free hugetlb page path

mm, hwpoison: fix condition in free hugetlb page path This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.12 by commit...

GSD-2021-1002834 platform/x86: intel_pmc_core: fix memleak on registration failure

platform/x86: intelpmccore: fix memleak on registration failure This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.12 by commit...

GSD-2021-1002829 Input: elantech - fix stack out of bound access in elantech_change_report_id()

Input: elantech - fix stack out of bound access in elantechchangereportid This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.12 by commit...

GSD-2021-1002820 ice: xsk: return xsk buffers back to pool when cleaning the ring

ice: xsk: return xsk buffers back to pool when cleaning the ring This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.12 by commit...

GSD-2021-1002816 phonet/pep: refuse to enable an unbound pipe

phonet/pep: refuse to enable an unbound pipe This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.89 by commit...

GSD-2021-1002814 hamradio: defer ax25 kfree after unregister_netdev

hamradio: defer ax25 kfree after unregisternetdev This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.89 by commit...

GSD-2021-1002801 hamradio: improve the incomplete fix to avoid NPD

hamradio: improve the incomplete fix to avoid NPD This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.169 by commit...

GSD-2021-1002782 hamradio: defer ax25 kfree after unregister_netdev

hamradio: defer ax25 kfree after unregisternetdev This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.260 by commit...

GSD-2021-1002775 phonet/pep: refuse to enable an unbound pipe

phonet/pep: refuse to enable an unbound pipe This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.4.297 by commit...

Backdoor.Win32.Visiotrol.10 Insecure Password Storage

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/f9dc0a462ada737f36efafac56f22b97.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Visiotrol.10 Vulnerability: Insecure Password Storage Description: The malware listen...

GSD-2021-1002757 btrfs: fix memory leak in __add_inode_ref()

btrfs: fix memory leak in addinoderef This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.11 by commit 493ff661d434d6bdf02e3a21adae04d7a0b4265...

GSD-2021-1002736 tee: amdtee: fix an IS_ERR() vs NULL bug

tee: amdtee: fix an ISERR vs NULL bug This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.11 by commit 832f3655c6138c23576ed268e31cc76e0f05f2b...

GSD-2021-1002729 bpf: Fix kernel address leakage in atomic fetch

bpf: Fix kernel address leakage in atomic fetch This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.11 by commit...

GSD-2021-1002717 xen/netfront: harden netfront against event channel storms

xen/netfront: harden netfront against event channel storms This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.88 by commit...

GSD-2021-1002715 scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()

scsi: scsidebug: Sanity check block descriptor length in respmodeselect This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.88 by commit...

GSD-2021-1002710 iocost: Fix divide-by-zero on donation from low hweight cgroup

iocost: Fix divide-by-zero on donation from low hweight cgroup This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.88 by commit...