UBUNTU-CVE-2024-24783

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for...

Uncaught Exception

Overview std/crypto/x509 is a Go standard library package std/crypto/x509 Affected versions of this package are vulnerable to Uncaught Exception. Go Vulnerability Report: Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify ...

The vulnerability of the tls_decrypt_done() function in the net/tls/tls_sw.c module of the TLS (Transport Layer Security) protocol implementation in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tlsdecryptdone function in the net/tls/tlssw.c module of the TLS Transport Layer Security protocol implementation in the Linux operating system is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the...

DEBIAN-CVE-2023-52527

In the Linux kernel, the following vulnerability has been resolved: ipv4, ipv6: Fix handling of transhdrlen in ip,6appenddata Including the transhdrlen in length is a problem when the packet is partially filled e.g. something like sendMSGMORE happened previously when appending to an IPv4 or IPv6...

DEBIAN-CVE-2023-52505

In the Linux kernel, the following vulnerability has been resolved: phy: lynx-28g: serialize concurrent physetmodeext calls to shared registers The protocol converter configuration registers PCC8, PCCC, PCCD implemented by the driver, as well as others, control protocol converters from multiple...

UBUNTU-CVE-2023-52527

In the Linux kernel, the following vulnerability has been resolved: ipv4, ipv6: Fix handling of transhdrlen in ip,6appenddata Including the transhdrlen in length is a problem when the packet is partially filled e.g. something like sendMSGMORE happened previously when appending to an IPv4 or IPv6...

OpenBSD Security Vulnerabilities

OpenBSD is a cross-platform, BSD-based, UNIX-like operating system from the Canadian OpenBSD project group. A security vulnerability exists in versions prior to OpenBSD 7.3 errata 016, which stems from an l2tp message containing an AVP of incorrect length that causes a crash...

CVE-2024-20294

A vulnerability in the Link Layer Discovery Protocol LLDP feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling of specific fields i...

The vulnerability in the full-screen mode of Mozilla Firefox, Firefox ESR, and the email client Thunderbird allows attackers to perform spear-phishing attacks.

The vulnerability in the full-screen mode of browsers such as Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to an incorrect limitation on the number of user interface layers or frames that can be displayed. Exploiting this vulnerability allows a malicious actor to...

Ubuntu 22.04 LTS : Linux kernel (Low Latency) vulnerabilities (USN-6653-3)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6653-3 advisory. It was discovered that a race condition existed in the ATM Asynchronous Transfer Mode subsystem of the Linux kernel, leading to a use-after-free...

The vulnerability in the implementation of the browser application interfaces of Mozilla Firefox, Firefox ESR, and the email client Thunderbird allows a hacker to display an alertdialog on a different website.

The vulnerability in the implementation of the browser application interfaces of Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to an incorrect limitation on the number of user interface layers or frames that can be displayed. Exploiting this vulnerability allows a...

Cisco FXOS and NX-OS Software Link Layer Discovery Protocol Denial of Service Vulnerability

A vulnerability in the Link Layer Discovery Protocol LLDP feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling of specific fields i...

The vulnerability of the `ksmbd_tcp_new_connection()` function in the `fs/smb/server/transport_tcp.c` module, which is part of the SMB (Server Message Block) networking protocol implementation in the ksmbd server kernel of the Linux operating system. This vulnerability allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the ksmbdtcpnewconnection function in the fs/smb/server/transporttcp.c module, which is part of the SMB Server Message Block networking protocol implementation in the ksmbd server kernel of the Linux operating system, relates to the use of memory after it is freed. Exploiting...

PT-2024-1971

Name of the Vulnerable Software and Affected Versions Cisco FXOS Software affected versions not specified Cisco NX-OS Software affected versions not specified Description A vulnerability in the Link Layer Discovery Protocol LLDP feature could allow an unauthenticated, adjacent attacker to cause a...

INTMAX Launches Plasma Next to Scale Ethereum with Stateless Layer

By Uzair Amir Made available under an open-source license after rigorous academic research, Plasma Next allows anyone to fork the code and launch the network. This is a post from HackRead.com Read the original post: INTMAX Launches Plasma Next to Scale Ethereum with Stateless Layer...

PT-2024-15210 · WordPress · Pagelayer

Name of the Vulnerable Software and Affected Versions: The Page Builder: Pagelayer WordPress plugin versions prior to 1.8.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, f...

UBUNTU-CVE-2021-46906

In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: fix info leak in hidsubmitctrl In hidsubmitctrl, the way of calculating the report length doesn't take into account that report-size can be zero. When running the syzkaller reproducer, a report of size 0 causes...

CVE-2024-23836 crafted traffic can cause denial of service

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 6.0.16 and 7.0.3, an attacker can craft traffic to cause Suricata to use far more CPU and memory for processing the traffic than needed, which can lead to extrem...

CVE-2024-23835 Suricata's pgsql: memory exhaustion use on record parsing

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.3, excessive memory use during pgsql parsing could lead to OOM-related crashes. This vulnerability is patched in 7.0.3. As workaround, users can disable the...

[SECURITY] [DLA 3740-1] gnutls28 security update

Debian LTS Advisory DLA-3740-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin February 26, 2024 https://wiki.debian.org/LTS Package : gnutls28 Version : 3.6.7-4+deb10u12 CVE ID : CVE-2024-0553 Debian Bug : 1061046 Hubert Kario discovered that GnuTLS, a portable...