Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2024:0267-1 Rating: important References: 1229897 Cross-References: CVE-2024-7969 CVE-2024-8193 CVE-2024-8194 CVE-2024-8198 CVSS scores: CVE-2024-7969 NVD : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affecte...

Exploit for Code Injection in Geoserver

GeoExplorer GeoExplorer is a mass scanner project consisting...

Security Bulletin: Denial of service and server-side request forgery might affect IBM Storage Defender – Resiliency Service

Summary IBM Storage Defender – Resiliency Service is vulnerable and can result in data confidentiality and service availabilty issues. The vulnerabilities have been addressed. CVE-2024-39249, CVE-2024-39338 Vulnerability Details CVEID:CVE-2024-39249 DESCRIPTION: Async is vulnerable to a denial of...

Security update for plasma5-workspace (moderate)

openSUSE Security Update: Security update for plasma5-workspace Announcement ID: openSUSE-SU-2024:0161-1 Rating: moderate References: 1225774 1226110 Cross-References: CVE-2024-36041 CVSS scores: CVE-2024-36041 NVD : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.15.28 packages and security update

Red Hat OpenShift Container Platform release 4.15.28 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a security impact of...

An AWS Configuration Issue Could Expose Thousands of Web Apps

Amazon has updated its instructions for how customers should more securely implement AWS's traffic-routing service known as Application Load Balancer, but it's not clear everyone will get the memo...

Khoj 安全漏洞

Khoj is an open source application from Khoj AI. It can be used to create ready-to-use personal AI agents for users. A security vulnerability exists in versions prior to Khoj 1.15.0 that stems from parameters not being properly cleaned, allowing users to insert arbitrary HTML into task...

Medium: p7zip

Issue Overview: The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 for 7zz contains a heap-based buffer overflow that allows an attacker to overwrite two bytes at multiple offsets beyond the allocated buffer size: buffer+512i-2, for i=9, i=10, i=11, etc. CVE-2023-52168 The NtfsHandler.cpp NTF...

CVE-2024-44083: Allocation of Resources Without Limits or Throttling

ida64.dll in Hex-Rays IDA Pro through 8.4 crashes when there is a section that has many jumps linked, and the final jump corresponds to the payload from where the actual entry point will be invoked. NOTE: in many use cases, this is an inconvenience but not a security issue...

Medium: tpm2-tss

Issue Overview: tpm2-tss: arbitrary quote data may go undetected by FapiVerifyQuote CVE-2024-29040 Affected Packages: tpm2-tss Issue Correction: Run dnf update tpm2-tss --releasever 2023.5.20240819 to update your system. New Packages: aarch64: tpm2-tss-fapi-4.0.2-1.amzn2023.aarch64 ...

SUSE CVE-2024-43843

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix out-of-bounds issue when preparing trampoline image We get the size of the trampoline image during the dry run phase and allocate memory based on that size. The allocated image will then be populated with...

CVE-2024-43843 riscv, bpf: Fix out-of-bounds issue when preparing trampoline image

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix out-of-bounds issue when preparing trampoline image We get the size of the trampoline image during the dry run phase and allocate memory based on that size. The allocated image will then be populated with...

CVE-2024-43840

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix trampoline for BPFTRAMPFCALLORIG When BPFTRAMPFCALLORIG is set, the trampoline calls bpftrampenter and bpftrampexit functions, passing them the struct bpftrampimage im pointer as an argument in R0. The trampoline...

Low: ca-certificates

Issue Overview: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.07.4 recognized root certificates from GLOBALTRUST. Certifi 2024.07.04 removes ro...

Medium: krb5

Issue Overview: krb5: GSS message token handling CVE-2024-37370 In MIT Kerberos 5 aka krb5 before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields. CVE-2024-37371 Affected Packages: krb5 Issue Correction: Run...

Medium: ghostscript

Issue Overview: Artifex Ghostscript before 10.03.0 has a stack-based buffer overflow in the pdfiapplyfilter function via a long PDF filter name. CVE-2024-29506 Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters...

Security update for opera (important)

openSUSE Security Update: Security update for opera Announcement ID: openSUSE-SU-2024:0242-1 Rating: important References: Cross-References: CVE-2024-6772 CVE-2024-6773 CVE-2024-6774 CVE-2024-6775 CVE-2024-6776 CVE-2024-6777 CVE-2024-6778 CVE-2024-6779 Affected Products: openSUSE Leap 15.6:NonFre...

GhostWrite: New T-Head CPU Bugs Expose Devices to Unrestricted Attacks

A team of researchers from the CISPA Helmholtz Center for Information Security in Germany has disclosed an architectural bug impacting Chinese chip company T-Head's XuanTie C910 and C920 RISC-V CPUs that could allow attackers to gain unrestricted access to susceptible devices. The vulnerability h...

June 11, 2024—Hotpatch KB5039330 (OS Build 20348.2522)

None None...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to denial of service due to Rack ( CVE-2024-26146 )

Summary Rack is used by IBM Cloud Pak for Data as part of the platform. CVE-2024-26146. Vulnerability Details CVEID:CVE-2024-26146 DESCRIPTION: Rack is vulnerable to a denial of service, caused by improper validation of user-supplied input by the header parsing process. By sending a specially...