[SECURITY] Fedora 40 Update: rust-uu_head-0.0.23-3.fc40

head uutils display the first lines of input...

[SECURITY] Fedora 40 Update: rust-uu_cut-0.0.23-3.fc40

cut uutils display byte/field columns of input lines...

traceroute: improper command line parsing

A vulnerability was found in traceroute. This security issue is caused by wrapper scripts that do not properly parse command lines...

CVE-2023-52872

The CVE-2023-52872 vulnerability affects the Linux kernel tty/n_gsm subsystem. A race in gsm_cleanup_mux() during the cleanup of GSM DLCIs can spuriously change virtual modem status lines while data/timers are being torn down, risking a kernel panic when resources have already been removed. The f...

golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm

A flaw was discovered in Go's net/http standard library package. When parsing a multipart form either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile, limits on the total size of the parsed form were not applied to the...

GHSA-6G7W-8WPP-FRHJ Denial of Service Vulnerability in Rustls Library

Summary rustls::ConnectionCommon::completeio could fall into an infinite loop based on network input. Details Verified at 0.22 and 0.23 rustls, but 0.21 and 0.20 release lines are also affected. tokio-rustls and rustls-ffi do not call completeio and are not affected. rustls::Stream and...

CVE-2024-28247 Pihole Authenticated Arbitrary File Read with root privileges

The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software. A vulnerability has been discovered in Pihole that allows an authenticated user on the platform to read internal server files arbitrarily, and because the application runs...

GO-2024-2599 Memory exhaustion in multipart form parsing in net/textproto and net/http

When parsing a multipart form either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile, limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a...

PT-2024-21356 · Swftools · Swftools

Name of the Vulnerable Software and Affected Versions: swftools version 0.9.2 Description: The issue is related to a segmentation violation in the function free lines at swftools/lib/modules/swfshape.c. This indicates a potential memory access error that could lead to unexpected program behavior ...

UBUNTU-CVE-2024-26622

In the Linux kernel, the following vulnerability has been resolved: tomoyo: fix UAF write bug in tomoyowritecontrol Since tomoyowritecontrol updates head-writebuf when write of long lines is requested, we need to fetch head-writebuf after head-iosem is held. Otherwise, concurrent write requests c...

Rancher 'Audit Log' leaks sensitive information

Impact A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. Rancher Audit Logging is an opt-in feature, only deployments that have it enabled and have AUDITLEVEL set to 1 or above are impacted by this issue. The leaks might be caught in the...

The vulnerability of the NEXO-OS operating system in the Bosch Nexo cordless nutrunner and Bosch Nexo special cordless nutrunner tools for assembly work in production lines allows a intruder to gain access to and read arbitrary files.

The vulnerability of the NEXO-OS operating system for tools used in production line assembly work, such as the Bosch Nexo cordless nutrunner and the Bosch Nexo special cordless nutrunner, is related to an incorrect limitation on the path name to the restricted access catalog. Exploiting this...

avahi: Local DoS by event-busy-loop from writing long lines to /run/avahi-daemon/socket

A flaw was found in avahi. The event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the clientwork function, allowing a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the availability of th...

RHCOS 4 : OpenShift Container Platform 4.12.6 (RHSA-2023:1033)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:1033 advisory. - cri-o: /etc/passwd tampering privesc CVE-2022-4318 Note that Nessus has not tested for this issue but has instead relied only on the...

RHCOS 4 : OpenShift Container Platform 4.11.34 (RHSA-2023:1503)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:1503 advisory. - cri-o: /etc/passwd tampering privesc CVE-2022-4318 Note that Nessus has not tested for this issue but has instead relied only on the...

GHSA-G4X3-MFPJ-F335 chasquid HTTP Request/Response Smuggling vulnerability

chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted...

Design/Logic Flaw

chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted...

CVE-2023-52354

chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted...

CVE-2023-52354

chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted...

CVE-2023-52354

chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted...