podman: Podman kube play command may overwrite host files

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the targ...

PT-2023-35111 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.93 Description: The issue concerns checking font dimension limits. It was introduced in version v2.6.22 and fixed in version v5.15.93. The actual impact and attack plausibility have not yet been proven...

PT-2022-36253 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.78 Description: A potential security issue has been identified in the Linux Kernel. The actual impact and attack plausibility have not yet been proven. The issue was introduced in version v2.6.39 and is...

DEBIAN-CVE-2022-43705

In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 November 2016...

PT-2022-35088 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue is related to the drm/msm/dpu component, specifically with the indexing of dpu kms-hw vbif using vbif idx. This is a potential security vulnerability, although its actual impact and...

PT-2022-33710 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.64 Description: The issue concerns data-races around weight p and dev weight rtx bias. It was introduced in version v4.11 and fixed in version v5.15.64. The actual impact and attack plausibility have not y...

GSD-2021-1002065 riscv, bpf: Fix potential NULL dereference

riscv, bpf: Fix potential NULL dereference This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.77 by commit...