Important: bind

Issue Overview: It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate...

GLSA-202412-15 : OpenSC: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202412-15 OpenSC: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in OpenSC. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly fro...

GLSA-202412-12 : PostgreSQL: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202412-12 PostgreSQL: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block...

GLSA-202412-04 : Mozilla Firefox: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202412-04 Mozilla Firefox: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in Mozilla Firefox. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description...

kernel: KVM: x86/pmu: Disable support for adaptive PEBS

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/pmu: Disable support for adaptive PEBS The Linux kernel CVE team has assigned CVE-2024-26992 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050144-CVE-2024-26992-4f0e@gregkh/T...

Medium: amazon-ecr-credential-helper

Issue Overview: The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. CVE-2024-24790 Affected Packages: amazon-ecr-credential-helper Note: This advisory is...

Important: qemu

Issue Overview: A double free vulnerability was found in QEMU virtio devices virtio-gpu, virtio-serial-bus, virtio-crypto, where the memreentrancyguard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to crash the QEMU process on...

Important: python3

Issue Overview: An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can r...

Important: cpio

Issue Overview: cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive. CVE-2015-1197 Affected Packages: cpio Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ...

Important: tomcat

Issue Overview: Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly...

Important: python-pillow

Issue Overview: Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 which was about the expression parameter. CVE-2023-50447 Affected Packages: python-pillow Note: This advisory is applicable to Amaz...

Medium: containerd

Issue Overview: A flaw was found in containerd CRI plugin. Containers launched through containerd CRI implementation that share the same image may receive incorrect environment variables, including values that are defined for other containers. The highest threat from this vulnerability is to data...

Important: mariadb

Issue Overview: A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in...

Important: kernel

Issue Overview: A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in tableclear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component. CVE-2023-2269 In the Linux kernel through 6.3.1, a use-after-free in...

Exploit for Argument Injection in Atlassian Bitbucket

CVE-2022-36804: Pre-Auth RCE in Atlassian Bitbucket Server A c...

[ASA-202107-19] ruby-addressable: denial of service

Arch Linux Security Advisory ASA-202107-19 ========================================== Severity: Medium Date : 2021-07-06 CVE-ID : CVE-2021-32740 Package : ruby-addressable Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2136 Summary ======= The package...

[ASA-202101-41] jenkins: multiple issues

Arch Linux Security Advisory ASA-202101-41 ========================================== Severity: High Date : 2021-01-20 CVE-ID : CVE-2021-21602 CVE-2021-21603 CVE-2021-21604 CVE-2021-21605 CVE-2021-21606 CVE-2021-21607 CVE-2021-21608 CVE-2021-21609 CVE-2021-21610 CVE-2021-21611 Package : jenkins...

Virtuozzo Linux Errata and Bugfix Advisory 2020:5047

Upstream security update. Follow RHBA-2020:5047 for details...

[ASA-202004-1] chromium: arbitrary code execution

Arch Linux Security Advisory ASA-202004-1 ========================================= Severity: High Date : 2020-04-01 CVE-ID : CVE-2020-6450 CVE-2020-6451 CVE-2020-6452 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1123 Summary ======= Th...

USN-3983-1 linux vulnerabilities

Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Giorgi Maisuradze, Dan Horea Lutas, Andrei Lutas, Volodymyr Pikhur, Stephan van Schaik, Alyssa Milburn, Sebastian Österlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida, Moritz Lipp, Michael Schwarz, and Daniel Gruss discovered...