GSD-2022-1007610 xen/gntdev: Prevent leaking grants

xen/gntdev: Prevent leaking grants This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.298 by commit 49bb053b1ec367b6883030eb2cca696e91435679,...

GSD-2022-1006899 xen/gntdev: Prevent leaking grants

xen/gntdev: Prevent leaking grants This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.3 by commit 273f6a4f71be12e2ec80a4919837d6e4fa933a04, it...

PT-2022-35154 · Xen +1 · Xen/Gntdev +1

Name of the Vulnerable Software and Affected Versions: xen/gntdev versions v5.19 through v6.0.2 Description: The issue is related to leaking grants in xen/gntdev. The actual impact and attack plausibility have not yet been proven. It was introduced in version v5.19 and fixed in Linux Kernel versi...

SUSE SLED15: xen / xen-devel / xen-doc-html / xen-libs / xen-libs-32bit / etc (SUSE-SU-2022:3727-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3727-1 advisory. Updated to version 4.16.2 bsc1027519: - CVE-2022-33746: Fixed DoS due to excessively long P2M po...

CVE-2022-33748

lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a result two cooperating guests granting each other transitive grants can cause locks to be...

UBUNTU-CVE-2022-33748

lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a result two cooperating guests granting each other transitive grants can cause locks to be...

Design/Logic Flaw

lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a result two cooperating guests granting each other transitive grants can cause locks to be...

lock order inversion in transitive grant copy handling

ISSUE DESCRIPTION As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a result two cooperating guests granting each other transitive grants can cause locks to be acquired nested within one another, b...

GSD-2022-1005710 xen/grants: prevent integer overflow in gnttab_dma_alloc_pages()

xen/grants: prevent integer overflow in gnttabdmaallocpages This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.142 by commit...

GSD-2022-1005396 xen/grants: prevent integer overflow in gnttab_dma_alloc_pages()

xen/grants: prevent integer overflow in gnttabdmaallocpages This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.66 by commit...

GSD-2022-1004968 xen/grants: prevent integer overflow in gnttab_dma_alloc_pages()

xen/grants: prevent integer overflow in gnttabdmaallocpages This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.8 by commit...

CVE-2022-36051 Broken Authorization in ZITADEL Actions

ZITADEL combines the ease of Auth0 and the versatility of Keycloak.Actions, introduced in ZITADEL 1.42.0 on the API and 1.56.0 for Console, is a feature, where users with role.ORGOWNER are able to create Javascript Code, which is invoked by the system at certain points during the login. Actions,...

Price Reduction - Azure Spring Apps does more, costs less!

We believe in providing the most innovative cloud offerings at incredibly competitive prices. As we operate Azure Spring Apps, we continue to build efficiencies and economies of scale. We are passing those efficiencies to you. Many customers have asked us to lower the size of the base unit to mak...

Is 3rd Party App Access the New Executable File?

It's no secret that 3rd party apps can boost productivity, enable remote and hybrid work and are overall, essential in building and scaling a company's work processes. An innocuous process much like clicking on an attachment was in the earlier days of email, people don't think twice when connecti...

New Research Paper: Pre-hijacking Attacks on Web User Accounts

In 2020, MSRC awarded two Identity Project Research Grants to support external researchers working to further strengthen the security of identity protocols and systems. Today we are pleased to release the results of the first of these projects. This research, led by independent security researche...

GSD-2022-1000938 xen/xenbus: don't let xenbus_grant_ring() remove grants in error case

xen/xenbus: don't let xenbusgrantring remove grants in error case This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.306 by commit...

GSD-2022-1000918 xen/xenbus: don't let xenbus_grant_ring() remove grants in error case

xen/xenbus: don't let xenbusgrantring remove grants in error case This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.271 by commit...

SUSE SLES12 Security Update : kernel (Live Patch 41 for SLE 12 SP3) (SUSE-SU-2021:4052-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:4052-1 advisory. This update for the Linux Kernel 4.4.180-94150 fixes several issues. The following security issues were fixed: - CVE-2021-0935: In...

CVE-2021-40809

An issue was discovered in Jamf Pro before 10.32.0, aka PI-009921. An account can be granted incorrect privileges in response to authentication that uses specific sign-on workflows...

Mozilla: Permission Prompt could be overlaid, resulting in user confusion and potential spoofing

By displaying a form validity message in the correct location at the same time as a permission prompt such as for geolocation, the validity message could have obscured the prompt, resulting in the user potentially being tricked into granting the permission. This vulnerability affects Firefox 94,...