PT-2023-21795 · Wlan Hal · Wlan Hal

Name of the Vulnerable Software and Affected Versions: WLAN HAL affected versions not specified Description: The issue is related to memory corruption in the WLAN HAL when processing Tx/Rx commands from QDART. This can potentially lead to unspecified consequences. There is no information provided...

PT-2023-21813 · Wlan Hal · Wlan Hal

Name of the Vulnerable Software and Affected Versions: WLAN HAL affected versions not specified Description: The issue is related to memory corruption in the WLAN HAL while handling command streams through WMI interfaces. This can potentially lead to security flaws affecting devices...

passt bug fix update

An update is available for passt. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list passt implements a translation layer between a Layer-2 network interface and...

RLSA-2023:3847 Moderate: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: tls: race condition in dotlsgetsockopt may lead to use-after-free or NULL pointer dereference CVE-2023-28466 For more details about the security issues, including the impact, a CVSS score...

CLSA-2023-1693426883 kernel: Fix of 20 CVEs

netfilter: nftsetpipapo: fix improper element removal CVE-2023-4004 - net: tun: fix bugs for oversize packet when napi frags enabled CVE-2023-3812 - net/sched: clsfw: Fix improper refcount update leads to use-after-free CVE-2023-3776 - net/sched: schqfq: account for stab overhead in qfqenqueue...

kernel: tls: race condition in do_tls_getsockopt may lead to use-after-free or NULL pointer dereference

A use-after-free flaw was found in the dotlsgetsockopt function in net/tls/tlsmain.c in the Transport Layer Security TLS in the Network subcompact in the Linux kernel. This flaw allows an attacker to cause a NULL pointer dereference problem due to a race condition...

kernel: tls: race condition in do_tls_getsockopt may lead to use-after-free or NULL pointer dereference

A use-after-free flaw was found in the dotlsgetsockopt function in net/tls/tlsmain.c in the Transport Layer Security TLS in the Network subcompact in the Linux kernel. This flaw allows an attacker to cause a NULL pointer dereference problem due to a race condition...

kernel: tls: race condition in do_tls_getsockopt may lead to use-after-free or NULL pointer dereference

A use-after-free flaw was found in the dotlsgetsockopt function in net/tls/tlsmain.c in the Transport Layer Security TLS in the Network subcompact in the Linux kernel. This flaw allows an attacker to cause a NULL pointer dereference problem due to a race condition...

SUSE CVE-2023-40217

An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers such as HTTP servers that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is...

The vulnerability of the MongoDB database management system, related to improper verification of client certificates, allows a perpetrator to establish a TLS connection with the server.

The vulnerability of the MongoDB database management system is related to improper verification of client certificates. Exploiting this vulnerability allows an attacker who operates remotely to establish a TLS connection with the server...

Hot Rod 信任管理问题漏洞

Hot Rod is a wired protocol used by Infinispan clients to communicate with remote grids from the Infinispan organization. A security vulnerability exists in Hot Rod that stems from not enabling hostname authentication when using TLS, which could lead to a man-in-the-middle attack...

ALSA-2023:4864 Important: cups security update

The Common UNIX Printing System CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fixes: cups: Information leak through Cups-Get-Document operation CVE-2023-32360 For more details about the security issues, including the impact, a CVSS score,...

PT-2023-8899 · Unknown +9 · Frrouting Frr +9

Name of the Vulnerable Software and Affected Versions: FRRouting FRR versions through 9.0 Description: An issue was discovered in FRRouting FRR where the bgpd/bgp packet.c file processes NLRIs if the attribute length is zero. This can allow a remote attacker to cause a denial of service...

PT-2023-5645 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software affected versions not specified Description: A vulnerability in the Layer 2 Tunneling Protocol L2TP feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS...

ALPINE-CVE-2023-40217

An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers such as HTTP servers that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is...

AZL-31170 CVE-2023-40217 affecting package python3 for versions less than 3.9.19-1

An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers such as HTTP servers that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is...

UBUNTU-CVE-2023-40217

An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers such as HTTP servers that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is...

PT-2023-27521 · Ironic +2 · Ironic +2

Name of the Vulnerable Software and Affected Versions: ironic-image versions prior to capm3-v1.4.3 Description: The issue arises when Ironic is not deployed with TLS and does not have API and Conductor split into separate services, resulting in unprotected access to the API. By default, Ironic AP...

Design/Logic Flaw

A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security TLS in the SICK LMS5xx. This lack of encryption in the communication channel can lead to the unauthorized disclosure of sensitive information. The attacker can...

CVE-2023-4420

CVE-2023-4420 affects SICK LMS5xx devices. The vulnerability arises from the absence of Transport Layer Security, leaving the communication channel unencrypted and allowing a remote unprivileged attacker to eavesdrop and potentially manipulate data between LMS5xx and the client. Impacts include c...