Security update for the Linux Kernel (Live Patch 49 for SLE 15 SP2)

This update for the Linux Kernel 5.3.18-15020024194 fixes several issues. The following security issues were fixed: CVE-2024-35861: Fixed potential UAF in cifssignalcifsdforreconnect bsc1225312. CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6nhflushexceptions bsc1227651...

Malicious code in auth0-lock-browserify (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9512 Malicious code in auth0-lock-browserify (npm)

--- -= Per source details. Do not edit below this line.=-...

bonding: change ipsec_lock from spin lock to mutex

...

kernel: gfs2: Fix NULL pointer dereference in gfs2_log_flush

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix NULL pointer dereference in gfs2logflush In gfs2jindexfree, set sdp-sdjdesc to NULL under the log flush lock to provide exclusion against gfs2logflush. In gfs2logflush, check if sdp-sdjdesc is non-NULL before...

The vulnerability of the queued_spin_lock_slowpath() function in the qspinlock component of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the queuedspinlockslowpath function in the qspinlock component of the Linux operating system’s kernel is related to improper locking of resources. Exploiting this vulnerability could allow an attacker to cause a service failure...

net/mlx5e: Take state lock during tx timeout reporter

...

kernel: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()

A vulnerability was found in the Linux kernel's ext4 filesystem within the ext4fillsuper function, where uninitialized access to ratelimitstate-lock can occur, where the sysfs interface is registered before properly initializing rs-lock, potentially allowing other processes to modify rs-interval ...

CLSA-2024-1728935304 kernel: Fix of 12 CVEs

xfs: don't walk off the end of a directory data block CVE-2024-41013 - net/sched: clsu32: fix netns refcount changes in u32change CVE-2022-29581 - net/packet: fix slab-out-of-bounds access in packetrecvmsg CVE-2022-20368 - openvswitch: fix OOB access in reservesfasize CVE-2022-2639 - net: sched:...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix AUX buffer serialization CVE-2024-46713 In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between direct IO write and fsync when using same fd CVE-2024-46734 In the...

PCI: Add missing bridge lock to pci_bus_lock()

...

CVE-2024-4132

A DLL hijack vulnerability was reported in Lenovo Lock Screen that could allow a local attacker to execute code with elevated privileges...

CVE-2024-4132

A DLL hijack vulnerability was reported in Lenovo Lock Screen that could allow a local attacker to execute code with elevated privileges...

CVE-2024-4132

CVE-2024-4132 pertains to Lenovo Lock Screen and describes a DLL hijack that could allow a local attacker to execute code with elevated privileges. The affected component is Lenovo Lock Screen; the underlying issue is a DLL hijack, with local attack vector and high impact per the CVSS metrics (Lo...

CVE-2024-4132

A DLL hijack vulnerability was reported in Lenovo Lock Screen that could allow a local attacker to execute code with elevated privileges...

CVE-2024-4132

A DLL hijack vulnerability was reported in Lenovo Lock Screen that could allow a local attacker to execute code with elevated privileges...

PT-2024-29358 · Lenovo · Lenovo Lock Screen

Name of the Vulnerable Software and Affected Versions: Lenovo Lock Screen affected versions not specified Description: A DLL hijack vulnerability was reported that could allow a local attacker to execute code with elevated privileges. Recommendations: At the moment, there is no information about ...

Lenovo Lock Screen 安全漏洞

Lenovo Lock Screen is a lock screen application from the Chinese company Lenovo Lenovo. A security vulnerability exists in Lenovo Lock Screen. A local attacker could exploit the vulnerability to elevate privileges and execute code...

PT-2024-8240

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.11.0+ Description: The issue is related to a use-after-free vulnerability in the gsm cleanup mux function in the Linux kernel. This vulnerability can be exploited by an attacker to impact the confidentiality,...

CVE-2024-47660

In the Linux kernel, the following vulnerability has been resolved: fsnotify: clear PARENTWATCHED flags lazily In some setups directories can have many usually negative dentries. Hence fsnotifyupdatechilddentryflags function can take a significant amount of time. Since the bulk of this function...