[SECURITY] [DSA 5751-1] squid security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5751-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 19, 2024 https://www.debian.org/security/faq -...

Important: Red Hat Security Advisory: python-setuptools security update

An update for python-setuptools is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: python3.12-setuptools security update

Setuptools is a collection of enhancements to the Python 3 distutils that allow you to more easily build and distribute Python 3 packages, especially ones that have dependencies on other packages. This package also contains the runtime components of setuptools, necessary to execute the software...

Important: python-setuptools security update

The python-setuptools package provides a collection of enhancements to Python distribution utilities allowing convenient building and distribution of Python packages. Security Fixes: pypa/setuptools: Remote code execution via download functions in the packageindex module in pypa/setuptools...

CVE-2024-42305 ext4: check dot and dotdot of dx_root before making dir indexed

In the Linux kernel, the following vulnerability has been resolved: ext4: check dot and dotdot of dxroot before making dir indexed Syzbot reports a issue as follows: ============================================ BUG: unable to handle page fault for address: ffffed11022e24fe PGD 23ffee067 P4D...

CVE-2023-52889 apparmor: Fix null pointer deref when receiving skb during sock creation

In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix null pointer deref when receiving skb during sock creation The panic below is observed when receiving ICMP packets with secmark set while an ICMP raw socket is being created. SKCTXsk-label is updated in...

Russian Hackers Using Fake Brand Sites to Spread DanaBot and StealC Malware

Cybersecurity researchers have shed light on a sophisticated information stealer campaign that impersonates legitimate brands to distribute malware like DanaBot and StealC. The activity cluster, orchestrated by Russian-speaking cybercriminals and collectively codenamed Tusk, is said to encompass...

CVE-2024-42472

CVE-2024-42472 affects Flatpak before 1.14.0/1.15.10 and allows a malicious or compromised Flatpak app using persistent directories to access or write files outside the sandbox. The root cause is a symlink-following issue when mounting persistent (persist) directories, causing the bind mount to f...

CVE-2024-42472 Flatpak may allow access to files outside sandbox for certain apps

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and...

CVE-2024-42472

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and...

CVE-2024-24973

Improper input validation for some IntelR Distribution for GDB software before version 2024.0.1 may allow an authenticated user to potentially enable denial of service via local access...

CVE-2024-23495

Incorrect default permissions in some IntelR Distribution for GDB software before version 2024.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2024-23495

Incorrect default permissions in some IntelR Distribution for GDB software before version 2024.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2024-23491

Uncontrolled search path in some IntelR Distribution for GDB software before version 2024.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2024-23495

Incorrect default permissions in some IntelR Distribution for GDB software before version 2024.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2024-24973

CVE-2024-24973 describes improper input validation in Intel® Distribution for GDB prior to 2024.0.1, which may permit an authenticated user to cause a local denial-of-service. The vulnerability affects Intel Distribution for GDB software before 2024.0.1 (and is echoed in related Intel advisories)...

CVE-2024-24973

Improper input validation for some IntelR Distribution for GDB software before version 2024.0.1 may allow an authenticated user to potentially enable denial of service via local access...

CVE-2024-24973

Improper input validation for some IntelR Distribution for GDB software before version 2024.0.1 may allow an authenticated user to potentially enable denial of service via local access...

CVE-2024-23495

The CVE-2024-23495 entry concerns Intel(R) Distribution for GDB software with an on-disk permission issue: incorrect default permissions in versions before 2024.0.1 may permit an authenticated user to escalate privileges via local access. Affected component: Intel Distribution for GDB (intel-gdb)...

CVE-2024-23491

CVE-2024-23491 refers to an uncontrolled search path in Intel® Distribution for GDB software prior to 2024.0.1, potentially allowing an authenticated user with local access to escalate privileges. Intel’s advisory (INTEL-SA-01075) and related Red Hat/NVD references confirm the affected product: I...