GSD-2023-1001985 io_uring/io-wq: only free worker if it was allocated for creation

iouring/io-wq: only free worker if it was allocated for creation This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.7 by commit...

Security Bulletin: IBM PowerVM Novalink is vulnerable because Apache Commons IO could allow a remote attacker to traverse directories on the system

Summary IBM PowerVM Novalink is vulnerable because Apache Commons IO could allow a remote attacker to traverse directories on the system, caused by improper input validation by the FileNameUtils.normalize method. An attacker could send a specially-crafted URL request containing "dot dot" sequence...

PT-2023-35038 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v6.1.7 through v6.1.8 Description: The issue is related to a potential security vulnerability in the io uring/poll component. It was introduced in version v6.1.7 and fixed in version v6.1.8. The actual impact and attack...

PT-2023-35097 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.7 Description: The issue is related to the io uring/poll component. It was introduced in version v6.0 and fixed in version v6.1.7. The actual impact and attack plausibility have not yet been proven...

GHSA-4Q83-7CQ4-P6WG `tokio::io::ReadHalf<T>::unsplit` is Unsound

tokio::io::ReadHalf::unsplit can violate the Pin contract The soundness issue is described in the tokio/issues5372 Specific set of conditions needed to trigger an issue a !Unpin type in ReadHalf is unusual, combined with the difficulty of making any arbitrary use-after-free exploitable in Rust...

Security Bulletin: Vulnerability in Apache Commons IO affects IBM Process Mining (CVE-2021-29425)

Summary There is a vulnerability in Apache Commons IO that could allow aremote attacker to traverse directories on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2021-29425...

GSD-2023-1001787 io_uring/io-wq: only free worker if it was allocated for creation

iouring/io-wq: only free worker if it was allocated for creation This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.164 by commit...

GSD-2023-1001753 io_uring/io-wq: only free worker if it was allocated for creation

iouring/io-wq: only free worker if it was allocated for creation This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.89 by commit...

GSD-2023-1001691 io_uring/io-wq: only free worker if it was allocated for creation

iouring/io-wq: only free worker if it was allocated for creation This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.7 by commit...

PT-2023-34863 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.164 Description: The issue is related to the io uring/io-wq component, where a worker is freed without being allocated for creation. The actual impact and attack plausibility have not yet been proven...

PT-2023-34829 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.89 Description: The issue is related to the io uring/io-wq component, where a worker is freed without being allocated for creation. The actual impact and attack plausibility have not yet been proven...

PT-2023-34767 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.7 Description: The issue is related to the io uring/io-wq component, where a worker is freed without being allocated for creation. The actual impact and attack plausibility have not yet been proven...

PT-2023-34766 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.7 Description: The issue is related to io uring, where a lock overflowing occurs for IOPOLL. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2023-34806 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.7 Description: The issue is related to the io uring/poll component. It was introduced in version v6.0 and fixed in version v6.1.7. The actual impact and attack plausibility have not yet been proven...

PT-2023-34744 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v6.1.7 through v6.1.8 Description: The issue is related to a potential security vulnerability in the io uring/poll component. It was introduced in version v6.1.7 and fixed in version v6.1.8. The actual impact and attack...

PT-2023-34828 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.89 Description: The issue is related to io uring, where a lock overflowing occurs for IOPOLL. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

Malicious Package

Overview engine.io-client-v3 is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packa...

AZL-13169 CVE-2023-0468 affecting package kernel for versions less than 5.15.92.1-1

A use-after-free flaw was found in iouring/poll.c in iopollcheckevents in the iouring subcomponent in the Linux Kernel due to a race condition of pollrefs. This flaw may cause a NULL pointer dereference...

golang: io/fs: stack exhaustion in Glob

A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to impact availability...

Vulnerability of SNC_io parser<EW>: read_vertex(); vh->shalfloop(); component Nef_S2/SNC_io parser.h library of computational geometry algorithms CGAL, allowing an intruder to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the SNCioparser function involves unvalidated array indexing. Exploitation of this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures through a specially created file. This vulnerability is related to the...