kernel: ALSA: timer: Set lower bound of start tick time

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Set lower bound of start tick time Currently ALSA timer doesn't have the lower limit of the start tick time, and it allows a very small size, e.g. 1 tick with 1ns resolution for hrtimer. Such a situation may lead to ...

golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm

A flaw was discovered in Go's net/http standard library package. When parsing a multipart form either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile, limits on the total size of the parsed form were not applied to the...

tpm2-tools: arbitrary quote data may go undetected by tpm2_checkquote

A flaw was found in the tpm2-tools package. This issue occurs due to a missing check whether the magic number in attest is equal to TPM2GENERATEDVALUE, which can allow an attacker to generate arbitrary quote data that may not be detected by tpm2checkquote...

PT-2024-32648

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.115 Description The issue is related to an unsafe reading of environment files, potentially causing a denial of service in Netty. When loaded on a Windows application, Netty attempts to load a file that does not...

PT-2024-8837 · Intel · Intel Server Board S2600St Family Bios/Firmware Update

Name of the Vulnerable Software and Affected Versions: Intel Server Board S2600ST Family BIOS and Firmware Update software all versions Description: The issue is related to an uncontrolled search path element in the Intel Server Board S2600ST Family BIOS and Firmware Update software. This could...

CLSA-2024-1731341386 bzip2: Fix of CVE-2019-12900

CVE-2019-12900: accept as many selectors as the file format allows but ignore any larger than the theoretical maximum, BZMAXSELECTORS...

CLSA-2024-1731337736 bzip2: Fix of CVE-2019-12900

CVE-2019-12900: accept as many selectors as the file format allows but ignore any larger than the theoretical maximum, BZMAXSELECTORS...

SUSE CVE-2024-50218

In the Linux kernel, the following vulnerability has been resolved: ocfs2: pass u64 to ocfs2truncateinline maybe overflow Syzbot reported a kernel BUG in ocfs2truncateinline. There are two reasons for this: first, the parameter value passed is greater than ocfs2maxinlinedatawithxattr, second, the...

SUSE CVE-2024-50253

In the Linux kernel, the following vulnerability has been resolved: bpf: Check the validity of nrwords in bpfiterbitsnew Check the validity of nrwords in bpfiterbitsnew. Without this check, when multiplication overflow occurs for nrbits e.g., when nrwords = 0x0400-0001, nrbits becomes 64, stack...

PT-2024-32077 · Weechat +1 · Weechat +1

Name of the Vulnerable Software and Affected Versions: WeeChat versions prior to 4.4.2 Description: The issue is caused by an integer overflow and resultant buffer overflow at core/core-string.c when there are more than two billion items in a list. This affects functions such as string free split...

DEBIAN-CVE-2024-50253

In the Linux kernel, the following vulnerability has been resolved: bpf: Check the validity of nrwords in bpfiterbitsnew Check the validity of nrwords in bpfiterbitsnew. Without this check, when multiplication overflow occurs for nrbits e.g., when nrwords = 0x0400-0001, nrbits becomes 64, stack...

SUSE CVE-2024-50206

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: fix memory corruption during fq dma init The loop responsible for allocating up to MTKFQDMALENGTH buffers must only touch as many descriptors, otherwise it ends up corrupting unrelated memory. Fix the lo...

OESA-2024-2342 firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security Fixes: A permission leak could have occurred from a trusted site to an untrusted site via embed or object elements. This vulnerability affects Firefox 132, Firefox ESR 128.4,...

UBUNTU-CVE-2024-50206

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: fix memory corruption during fq dma init The loop responsible for allocating up to MTKFQDMALENGTH buffers must only touch as many descriptors, otherwise it ends up corrupting unrelated memory. Fix the lo...

DEBIAN-CVE-2024-50157

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Avoid CPU lockups due fifo occupancy check loop Driver waits indefinitely for the fifo occupancy to go below a threshold as soon as the pacing interrupt is received. This can cause soft lockup on one of the processor...

PT-2024-16667

Name of the Vulnerable Software and Affected Versions pam access affected versions not specified Red Hat Nan affected versions not specified Description A flaw was found in pam access, where certain rules in its configuration file are mistakenly treated as hostnames. This issue allows attackers t...

FFmpeg MMS Buffer Overflow DoS

The vulnerability of the MMS protocol in the FFmpeg multimedia library relates to reading data beyond the allowed buffer limits. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service failures...

SUSE CVE-2024-50129

In the Linux kernel, the following vulnerability has been resolved: net: pse-pd: Fix out of bound for loop Adjust the loop limit to prevent out-of-bounds access when iterating over PI structures. The loop should not reach the index pcdev-nrlines since we allocate exactly pcdev-nrlines number of P...

Oracle Linux 8 : container-tools:ol8 (ELSA-2024-8846)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-8846 advisory. aardvark-dns buildah cockpit-podman conmon containernetworking-plugins containers-common 1-82.0.1 - Updated removed references Orabug: 33473101 Alex...

CVE-2024-50129

In the Linux kernel, the following vulnerability has been resolved: net: pse-pd: Fix out of bound for loop Adjust the loop limit to prevent out-of-bounds access when iterating over PI structures. The loop should not reach the index pcdev-nrlines since we allocate exactly pcdev-nrlines number of P...