ruby:2.7 security, bug fix, and enhancement update

An update is available for rubygem-bson, rubygem-mysql2, ruby, rubygem-mongo, rubygem-pg, rubygem-abrt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Ruby is a...

Exploit for CVE-2021-24086

PoC exploit for CVE-2021-24086, a Windows TCP/IP Denial of Service Vulnerability. The target is the Windows TCP/IP stack, specifically the tcpip.sys driver, which is vulnerable to a NULL dereference. The vulnerability can be triggered remotely by sending a malicious UDP packet over IPv6. The...

UVI-2021-1000801 ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions

ipv6: Fix KASAN: slab-out-of-bounds Read in fib6nhflushexceptions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.10 by commit...

GSD-2021-1000769 ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions

ipv6: Fix KASAN: slab-out-of-bounds Read in fib6nhflushexceptions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.43 by commit...

UVI-2021-1000769 ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions

ipv6: Fix KASAN: slab-out-of-bounds Read in fib6nhflushexceptions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.43 by commit...

GSD-2021-1000747 ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions

ipv6: Fix KASAN: slab-out-of-bounds Read in fib6nhflushexceptions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.125 by commit...

UVI-2021-1000747 ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions

ipv6: Fix KASAN: slab-out-of-bounds Read in fib6nhflushexceptions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.125 by commit...

Contiki-NG Infinite Loop Vulnerability

Contiki-NG is an open source cross-platform operating system for next-generation IoT devices. An infinite loop vulnerability exists in the handling of IPv6 Neighbor Request NS messages in Contiki-NG versions prior to 4.6. An attacker could exploit this vulnerability to cause a denial of service...

CVE-2021-21279

Contiki-NG is an open-source, cross-platform operating system for internet of things devices. In verions prior to 4.6, an attacker can perform a denial-of-service attack by triggering an infinite loop in the processing of IPv6 neighbor solicitation NS messages. This type of attack can effectively...

Design/Logic Flaw

Contiki-NG is an open-source, cross-platform operating system for internet of things devices. In verions prior to 4.6, an attacker can perform a denial-of-service attack by triggering an infinite loop in the processing of IPv6 neighbor solicitation NS messages. This type of attack can effectively...

Out-of-bounds

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be triggered by 6LoWPAN packets sent to devices running Contiki-NG 4.6 and prior. The IPv6 header decompression function uncompresshdriphc does not perform proper boundary chec...

CVE-2021-21410 Out-of-bounds read in the 6LoWPAN implementation

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be triggered by 6LoWPAN packets sent to devices running Contiki-NG 4.6 and prior. The IPv6 header decompression function uncompresshdriphc does not perform proper boundary chec...

CVE-2021-21410

Contiki-NG vulnerability CVE-2021-21410: an out-of-bounds read in the 6LoWPAN IPv6 header decompression (uncompress_hdr_iphc) affects Contiki-NG 4.6 and earlier. The function does not perform proper boundary checks when reading from the packet buffer, enabling construction of a compressed 6LoWPAN...

CVE-2021-21279 Infinite loop in IPv6 neighbor solicitation processing

Contiki-NG is an open-source, cross-platform operating system for internet of things devices. In verions prior to 4.6, an attacker can perform a denial-of-service attack by triggering an infinite loop in the processing of IPv6 neighbor solicitation NS messages. This type of attack can effectively...

CVE-2021-21279

Contiki-NG prior to version 4.6 is affected by an infinite loop in the IPv6 Neighbor Solicitation handling which can lead to a denial-of-service due to the cooperative scheduling in the network stack. The issue is mitigated by upgrading to Contiki-NG 4.6 (patched) as the primary fix; an out-of-ba...

Nextcloud server processing logic error vulnerability

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A processing logic error vulnerability exists in the Nextcloud server, which stems from the fact that the Nextcloud server is vulnerable to brute-force attack...

Unbreakable Enterprise kernel security update

5.4.17-2102.202.5 - sctp: delay autoasconf init until binding the first addr Xin Long Orabug: 32907967 CVE-2021-23133 CVE-2021-23133 - dm ioctl: fix out of bounds array access when no devices Mikulas Patocka Orabug: 32860491 CVE-2021-31916 - uek-rpm: update kABI lists for the new symbols Saeed...

CVE-2021-22915

Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations. This could potentially result in an attacker bypassing rate-limit controls such as the Nextcloud brute-force protection...

Design/Logic Flaw

Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations. This could potentially result in an attacker bypassing rate-limit controls such as the Nextcloud brute-force protection...

CVE-2021-22915

Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations. This could potentially result in an attacker bypassing rate-limit controls such as the Nextcloud brute-force protection...