Fedora 39 : clang / compiler-rt / flang / libclc / libcxx / libomp / lld / lldb / etc (2023-67f0f8d186)

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-67f0f8d186 advisory. Update to LLVM 17.0.2 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Fedora: Security Advisory for lldb (FEDORA-2023-67f0f8d186)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

dotnet7.0 security, bug fix, and enhancement update

7.0.100-0.5.rc2.0.1 - Set TargetRid based on os release major version, add OL arm64 RuntimeIdentifier Orabug: 34671152 7.0.100-0.5.rc2 - Add lldb as a build dependency - Related: RHBZ2134641 7.0.100-0.4.rc2 - Enable ppc64le builds - Related: RHBZ2134641 7.0.100-0.3.rc2 - Update to .NET 7 RC 2 -...

llvm-toolset bug fix and enhancement update

An update is available for llvm-toolset. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux...

Malicious Package

Overview lldb-vscode is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious code in lldb-vscode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe9916629b31632e8891a1ad6e398d0a3159ec2c1ba97501fbe7f68b29e77f3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4330 Malicious code in lldb-vscode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe9916629b31632e8891a1ad6e398d0a3159ec2c1ba97501fbe7f68b29e77f3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

llvm-toolset:rhel8 bug fix update

An update is available for compiler-rt, lldb, lld, llvm, llvm-toolset, clang, libomp, python-lit. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list LLVM Toolset...

lldb bug fix and enhancement update

An update is available for lldb. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list LLDB is a next generation, high-performance debugger. It is built as a set of...

llvm-toolset:rhel8 bug fix and enhancement update

An update is available for compiler-rt, lldb, lld, llvm, llvm-toolset, clang, libomp, python-lit. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed...

ALSA-2021:4743 Moderate: llvm-toolset:rhel8 security update

LLVM Toolset provides the LLVM compiler infrastructure framework, the Clang compiler for the C and C++ languages, the LLDB debugger, and related tools for code analysis. Security Fixes: Developer environment: Unicode's bidirectional BiDi override characters can cause trojan source attacks...

ALEA-2021:4233 llvm-toolset:rhel8 bug fix and enhancement update

LLVM Toolset provides the LLVM compiler infrastructure framework, the Clang compiler for the C and C++ languages, the LLDB debugger, and related tools for code analysis. For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For...

llvm-toolset:rhel8 bug fix and enhancement update

LLVM Toolset provides the LLVM compiler infrastructure framework, the Clang compiler for the C and C++ languages, the LLDB debugger, and related tools for code analysis. For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For...

llvm-toolset:rhel8 bug fix update

An update is available for compiler-rt, lldb, lld, llvm, llvm-toolset, clang, libomp, python-lit. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list LLVM Toolset...

Apple macOS < 10.14.5 / iOS < 12.3 JavaScriptCore - Loop-Invariant Code Motion (LICM) in DFG JIT Leaves Stack Variable Uninitialized

While fuzzing JavaScriptCore, I encountered the following modified and commented JavaScript program which crashes jsc from current HEAD and release: // Run with --useConcurrentJIT=false // Fill the stack with the return value of the provided function. function stacksprayf // This function will...

Google Software Updater macOS - Unsafe use of Distributed Objects Privilege Escalation

Google Software Updater macOS - Unsafe use of Distributed Objects Privilege Escalation / Google software updater ships with Chrome on MacOS and installs a root service com.google.Keystone.Daemon.UpdateEngine which lives here:...

Based on jemalloc Android exploit skills----CENSUS-bug warning-the black bar safety net

Background description jemalloc-related research argp and huku in 2012 in Phrack published on: jemalloc memory allocator a separate use of themade-based on FreeBSD libc POC. argp and huku in 2012 BlackHat published: in Firefo play bad jemalloc metadata. argp in 2015 INFILTRATE on jemalloc exploit...

shopify-scripts: Segmentation fault due to bad memory access in kh_get_mt

Crash file is: values=0,0,0,0 unusedbutneeded= Hash= values.each do values.each do values & values.each do values.each do % 0=nil end end end end $ ./dev/bin/mruby crash.rb Segmentation fault: 11 $ lldb ./dev/bin/mruby crash.rb lldb target create "./dev/bin/mruby" Current executable set to...

shopify-scripts: Invalid memory write caused by incorrect upper bound in array_copy

Ok, here is a weird one! It only crashes in mruby, and can't be made to crash in mruby-engine as max memory possible to extend to is 256M which this requires more. The file is: values = 3,5,8 test = 1,6 results,= 1.2 values.each do |value| case value when test results 0x10000222d : movq %rdx, %ra...

Extensible Debugger UI For Hackers: Voltron

Voltron is an extensible debugger UI toolkit written in Python. It aims to improve the user experience of various debuggers LLDB, GDB, VDB and WinDbg by enabling the attachment of utility views that can retrieve and display data from the debugger host. By running these views in other TTYs, you ca...