CVE-2024-20681

CVE-2024-20681 affects Windows Subsystem for Linux and enables local elevation of privilege. CVSS v3.1 base score 7.8 (HIGH); attack vector LOCAL, privileges required LOW, user interaction NONE; impacts on confidentiality, integrity, and availability are HIGH. Connected documents reference Window...

CVE-2024-0213

A buffer overflow vulnerability in TA for Linux and TA for MacOS prior to 5.8.1 allows a local user to gain elevated permissions, or cause a Denial of Service DoS, through exploiting a memory corruption issue in the TA service, which runs as root. This may also result in the disabling of event...

PT-2023-31552 · Unknown +1 · Zed! For Mac +5

Name of the Vulnerable Software and Affected Versions: ZED! for Windows versions before Q.2020.3 through Q.2021.2 ZONECENTRAL for Windows versions before Q.2021.2 through 2023.5 ZEDMAIL for Windows versions before 2023.5 ZED! for Windows, Mac, Linux versions before 2023.5 Description: The issue...

USN-6340-2 linux-azure-5.4, linux-gcp-5.4, linux-gkeop, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp vulnerabilities

Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform permissions checks when handling HCI sockets. A physically proximate attacker could use this to cause a denial of service bluetooth communication. CVE-2023-2002 Zi Fan Tan discovered that the binder IPC...

PT-2023-5539 · Ibm · Ibm Db2

Name of the Vulnerable Software and Affected Versions: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server versions 10.5, 11.1, and 11.5 Description: The issue is related to insufficient input validation in the database management system, which can be exploited by a remote attacker to...

CVE-2023-28598

Zoom for Linux clients prior to 5.13.10 contain an HTML injection vulnerability. If a victim starts a chat with a malicious user it could result in a Zoom application crash...

PT-2023-21837 · Zoom · Zoom

Name of the Vulnerable Software and Affected Versions: Zoom for Linux clients versions prior to 5.13.10 Description: The issue is related to an HTML injection vulnerability. If a victim starts a chat with a malicious user, it could result in a Zoom application crash. Recommendations: For versions...

USN-6007-1 linux-gcp vulnerabilities

It was discovered that the Upper Level Protocol ULP subsystem in the Linux kernel did not properly handle sockets entering the LISTEN state in certain protocols, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execut...

USN-5975-1 linux-azure vulnerabilities

Updated on 2023-04-11: Please note that when USN 5975-1 was originally published, it incorrectly included the linux-gcp kernel for Ubuntu 16.04 ESM. References to that kernel have been removed from this USN and the correct information for it has been published in USN 6007-1. Original advisory...

OESA-2023-1157 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: There is a logic error in iouring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the ioprepasyncwork function the assumption that the last iograbidentity call cann...

USN-5924-1 linux-azure, linux-azure, linux-azure vulnerabilities

It was discovered that the Upper Level Protocol ULP subsystem in the Linux kernel did not properly handle sockets entering the LISTEN state in certain protocols, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execut...

Amazon Linux 2 : git (ALAS-2023-1943)

The version of git installed on the remote host is prior to 2.23.1-0. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1943 advisory. A flaw was found in the git fast-import command where it provides the export-marks feature that may unexpectedly overwrite...

USN-5883-1: Linux kernel (HWE) vulnerabilities

Kyle Zeng discovered that the sysctl implementation in the Linux kernel contained a stack-based buffer overflow. A local attacker could use this to cause a denial of service system crash or execute arbitrary code. CVE-2022-4378 It was discovered that an out-of-bounds write vulnerability existed i...

USN-5883-1 linux-hwe vulnerabilities

Kyle Zeng discovered that the sysctl implementation in the Linux kernel contained a stack-based buffer overflow. A local attacker could use this to cause a denial of service system crash or execute arbitrary code. CVE-2022-4378 It was discovered that an out-of-bounds write vulnerability existed i...

SUSE CVE-2010-4328

Multiple stack-based buffer overflows in opt/novell/iprint/bin/ipsmd in Novell iPrint for Linux Open Enterprise Server 2 SP2 and SP3 allow remote attackers to execute arbitrary code via unspecified LPR opcodes...

USN-5854-1 linux, linux-aws, linux-gcp-4.15, linux-kvm, linux-oracle, linux-raspi2 vulnerabilities

It was discovered that an out-of-bounds write vulnerability existed in the Video for Linux 2 V4L2 implementation in the Linux kernel. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2022-20369 Pawan Kumar Gupta, Alyssa Milburn, Ami...

AZL-13364 CVE-2023-0615 affecting package kernel for versions less than 5.15.122.1-2

A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs when a user triggers ioctls, such as VIDIOCSDVTIMINGS ioctl. This could allow a local user to crash the system if vivid test code enabled...

DEBIAN-CVE-2023-0615

A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs when a user triggers ioctls, such as VIDIOCSDVTIMINGS ioctl. This could allow a local user to crash the system if vivid test code enabled...

UBUNTU-CVE-2023-0615

A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs when a user triggers ioctls, such as VIDIOCSDVTIMINGS ioctl. This could allow a local user to crash the system if vivid test code enabled...

CVE-2022-34479

A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing attacks. This bug only affects Thunderbird for Linux. Other operating systems are unaffected.. This vulnerability affects...