CVE-2022-20846 Cisco IOS XR Software Cisco Discovery Protocol Buffer Overflow Vulnerability

A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the Cisco Discovery Protocol process to reload on an affected device. This vulnerability is due to a heap buffer overflow in certain Cisco Discovery...

USN-7088-5 linux-raspi, linux-raspi-5.4 vulnerabilities

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an integer overflow vulnerability. A local attacker could use this to cause a denial of service system crash. CVE-2022-36402 Several security issues were discovered in the Linux kernel. An attacker could...

AZL-53195 CVE-2024-10977 affecting package postgresql for versions less than 14.14-1

Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistake...

UBUNTU-CVE-2024-10977

Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistake...

The vulnerability of the cross-platform BitTorrent client qBittorrent, related to incorrect verification of SSL/TLS certificates, allows a hacker to perform a type of “man-in-the-middle” attack.

The vulnerability of the cross-platform BitTorrent client qBittorrent is related to incorrect verification of the SSL/TLS certificate authenticity. Exploiting this vulnerability allows a remote attacker to carry out a “man-in-the-middle” attack...

kroxylicious: Missing upstream Kafka TLS hostname verification

A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server's hostname, resulting in an insecure connection. For a successful attack to be performed, the attacker needs to perfor...

AZL-42952 CVE-2024-4741 affecting package openssl for versions less than 1.1.1k-31

Issue summary: Calling the OpenSSL API function SSLfreebuffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code...

FreeBSD : FreeBSD -- Unbounded allocation in ctl(4) CAM Target Layer (8caa5d60-a174-11ef-9a62-002590c1f29c)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 8caa5d60-a174-11ef-9a62-002590c1f29c advisory. The command ctlpersistentreserveout allows the caller to specify an arbitrary size which will be passed...

CVE-2024-45289 Unbounded allocation in ctl(4) CAM Target Layer

The fetch3 library uses environment variables for passing certain information, including the revocation file pathname. The environment variable name used by fetch1 to pass the filename to the library was incorrect, in effect ignoring the option. Fetch would still connect to a host presenting a...

CVE-2024-39281 Unbounded allocation in ctl(4) CAM Target Layer

The command ctlpersistentreserveout allows the caller to specify an arbitrary size which will be passed to the kernel's memory allocator...

CVE-2024-39281

The CVE-2024-39281 issue affects FreeBSD where the command ctl_persistent_reserve_out lets a caller specify an arbitrary size passed to the kernel memory allocator, enabling unbounded allocation in the ctl(4) CAM Target Layer and potentially causing a host DoS. The FreeBSD security advisory SA-24...

CVE-2024-39281 Unbounded allocation in ctl(4) CAM Target Layer

The command ctlpersistentreserveout allows the caller to specify an arbitrary size which will be passed to the kernel's memory allocator...

USN-7100-2: Linux kernel vulnerabilities

Supraja Sridhara, Benedict Schlüter, Mark Kuhne, Andrin Bertschi, and Shweta Shinde discovered that the Confidential Computing framework in the Linux kernel for x86 platforms did not properly handle 32-bit emulation on TDX and SEV. An attacker with access to the VMM could use this to cause a deni...

kernel: s390/qeth: Fix kernel panic after setting hsuid

A flaw was found in the Linux kernel's s390/qeth component. A local attacker with privileges to manage network devices could trigger a kernel panic by setting the hsuid attribute on an IQD Layer3 device while its network interface is active. This occurs because the kernel attempts to execute a nu...

kernel: tls: stop recv() if initial process_rx_list gave us non-DATA

In the Linux kernel, the following vulnerability has been resolved: tls: stop recv if initial processrxlist gave us non-DATA If we have a non-DATA record on the rxlist and another record of the same type still on the queue, we will end up merging them: - processrxlist copies the non-DATA record -...

kernel: tls: get psock ref after taking rxlock to avoid leak

In the Linux kernel, the following vulnerability has been resolved: tls: get psock ref after taking rxlock to avoid leak At the start of tlsswrecvmsg, we take a reference on the psock, and then call tlsrxreaderlock. If that fails, we return directly without releasing the reference. Instead of...

Moderate: Red Hat Security Advisory: lldpd security update

An update for lldpd is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

lldpd: out-of-bounds read when decoding SONMP packets

An out-of-bounds read vulnerability is present in lldpd. An attacker on the same network as the vulnerable system may use this vulnerability to leak memory data from the application or crash it by sending shorter SONMP packets than what is expected...

lldp/openvswitch: denial of service via externally triggered memory leak

A flaw was found in multiple versions of Open vSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service. The highest threat from this vulnerability is to system availability...

NetworkManager: Denial of Service

A flaw was found in NetworkManager. When a system running NetworkManager with DEBUG logs enabled and an interface eth1 configured with LLDP enabled, a malicious user could inject a malformed LLDP packet. NetworkManager would crash, leading to a denial of service...