CVE-2022-20792

A vulnerability in the regex module used by the signature database load module of Clam AntiVirus ClamAV versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an authenticated, local attacker to crash ClamAV at database load time, and possibly gain code execution...

ClamAV AntiVirus buffer error vulnerability

Clam AntiVirus is an open source antivirus engine from the Clamav team for detecting Trojans, viruses, malware and other malicious threats. A security vulnerability exists in Clam AntiVirus versions 0.104.0 through 0.104.2 versions 0.103 through 0.103.5, which stems from a boundary error in the...

GHSA-5CW4-GGX9-36VG Apache Tomcat Denial of Service via Malformed Request Headers

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and modjk load balancing are used, allows remote attackers to cause a denial of service application outage via a crafted request with invalid headers, related to temporary blocking of...

Apache Tomcat Denial of Service via Malformed Request Headers

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and modjk load balancing are used, allows remote attackers to cause a denial of service application outage via a crafted request with invalid headers, related to temporary blocking of...

SonicWall Global VPN Client code-related vulnerabilities

Sonicwall Global Vpn Client is a corporate VPN client from Sonicwall USA. SonicWall Global VPN Client suffers from a code issue vulnerability that stems from an untrusted search path at load time. An attacker could exploit the vulnerability to place a malicious file that would escalate privileges...

AZL-45285 CVE-2022-24735 affecting package compat-lua 5.1.5-17

Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the potentially higher privileges of another Redis user. The Lua scri...

ALPINE-CVE-2022-24735

Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the potentially higher privileges of another Redis user. The Lua scri...

DEBIAN-CVE-2022-24735

Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the potentially higher privileges of another Redis user. The Lua scri...

ALPINE-CVE-2022-24736

Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem is fixed in Redis versions 7.0.0 and...

UBUNTU-CVE-2022-24736

Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem is fixed in Redis versions 7.0.0 and...

CVE-2022-24735: Improper Control of Generation of Code

Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the potentially higher privileges of another Redis user. The Lua scri...

Internet Bug Bounty: CVE-2022-28738: Double free in Regexp compilation

Due to a bug in the Regexp compilation process, creating a Regexp object with a crafted source string could cause the same memory to be freed twice. This is known as a “double free” vulnerability. Note that, in general, it is considered unsafe to create and use a Regexp object generated from...

GSD-2022-1001736 ath11k: fix kernel panic during unload/load ath11k modules

ath11k: fix kernel panic during unload/load ath11k modules This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.34 by commit...

GSD-2022-1001555 bpf: Fix UAF due to race between btf_try_get_module and load_module

bpf: Fix UAF due to race between btftrygetmodule and loadmodule This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.19 by commit...

GSD-2022-1001450 scsi: qla2xxx: Fix crash during module load unload test

scsi: qla2xxx: Fix crash during module load unload test This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.19 by commit...

GSD-2022-1001412 ath11k: fix kernel panic during unload/load ath11k modules

ath11k: fix kernel panic during unload/load ath11k modules This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.20 by commit...

GSD-2022-1001128 scsi: qla2xxx: Fix crash during module load unload test

scsi: qla2xxx: Fix crash during module load unload test This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...

PT-2022-29518

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.12 through v5.17.1 Description The issue is related to a use-after-free UAF bug due to a race between btf try get module and load module. The actual impact and attack plausibility have not yet been proven...

PT-2022-29828

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.19 Description The issue is related to a use-after-free UAF bug due to a race between btf try get module and load module. The actual impact and attack plausibility have not yet been proven. Recommendations...

PT-2022-30139

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.12 through v5.15.32 Description The issue is related to a use-after-free UAF bug due to a race between btf try get module and load module. The actual impact and attack plausibility have not yet been proven...