SUSE SLES15: libnss_slurm2 / libpmi0 / libslurm36 / perl-slurm / slurm / etc (SUSE-SU-2023:4114-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:4114-1 advisory. - CVE-2023-41914: Fixed a filesystem handling race conditions that could lead to an attacker taking control of an arbitrary file. bsc1216207 Tenable ha...

Warning: Unpatched Cisco Zero-Day Vulnerability Actively Targeted in the Wild

Cisco has warned of a critical, unpatched security flaw impacting IOS XE software that's under active exploitation in the wild. Rooted in the web UI feature, the zero-day vulnerability is tracked as CVE-2023-20198 and has been assigned the maximum severity rating of 10.0 on the CVSS scoring syste...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : Redis vulnerabilities (USN-5221-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5221-1 advisory. It was discovered that Redis incorrectly handled certain specially crafted Lua scripts. A remote attacker could possibly use this...

SUSE-SU-2023:4000-1 Security update for yq

This update for yq fixes the following issues: yq was updated to 4.35.2 bsc1215808: Fixed number parsing as float bug in JSON 1756 Fixed string, null concatenation consistency 1712 Fixed expression parsing issue 1711 Update to 4.35.1: Added Lua output support Added BSD checksum format Update to...

Amazon Linux 2 : redis (ALASREDIS6-2023-002)

The version of redis installed on the remote host is prior to 6.2.13-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2REDIS6-2023-002 advisory. A heap-based buffer overflow flaw was found in Redis. This flaw allows an attacker to trick an authenticated user into executin...

Amazon Linux 2 : redis (ALASREDIS6-2023-007)

The version of redis installed on the remote host is prior to 6.2.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2REDIS6-2023-007 advisory. Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts...

Amazon Linux 2 : redis (ALASREDIS6-2023-003)

The version of redis installed on the remote host is prior to 6.2.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2REDIS6-2023-003 advisory. A flaw was found in the Redis database where Lua scripts can be manipulated to overcome ACL rules. This flaw allows an...

Important: redis

Issue Overview: A heap-based buffer overflow flaw was found in Redis. This flaw allows an attacker to trick an authenticated user into executing a specially crafted Lua script in Redis. This attack triggers a heap overflow in the cjson and cmsgpack libraries, resulting in heap corruption and...

Low: redis

Issue Overview: A flaw was found in the Redis database where Lua scripts can be manipulated to overcome ACL rules. This flaw allows an attacker with access to Redis to inject Lua code that executes the potentially higher privileges of another Redis user. CVE-2022-24735 A flaw was found in the Red...

Important: redis

Issue Overview: Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and...

Mysterious 'Sandman' Threat Actor Targets Telecom Providers Across Three Continents

A previously undocumented threat actor dubbed Sandman has been attributed to a set of cyber attacks targeting telecommunication providers in the Middle East, Western Europe, and the South Asian subcontinent. Notably, the intrusions leverage a just-in-time JIT compiler for the Lua programming...

[SECURITY] Fedora 37 Update: redis-7.0.13-1.fc37

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

[SECURITY] Fedora 38 Update: redis-7.0.13-1.fc38

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

tarantool:luaL_loadbuffer_fuzzer: Heap-buffer-overflow in parse_chunk

Project: https://github.com/tarantool/tarantool.git Detailed Report: https://oss-fuzz.com/testcase?key=5154420670988288 Project: tarantool Fuzzing Engine: libFuzzer Fuzz Target: luaLloadbufferfuzzer Job Type: libfuzzerasantarantool Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash...

tarantool:luaL_loadbuffer_fuzzer: Heap-buffer-overflow in parse_chunk

Project: https://github.com/tarantool/tarantool.git Detailed Report: https://oss-fuzz.com/testcase?key=5951830473179136 Project: tarantool Fuzzing Engine: libFuzzer Fuzz Target: luaLloadbufferfuzzer Job Type: libfuzzerasantarantool Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash...

Huawei EulerOS: Security Advisory for lua (EulerOS-SA-2023-2763)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for lua (EulerOS-SA-2023-2732)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 8 : lua (ELSA-2019-3706)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3706 advisory. 5.3.4-11 - Fix use after free in luaupvaluejoin 1670167 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

CVE-2023-4540

Improper Handling of Exceptional Conditions vulnerability in Daurnimator lua-http library allows Excessive Allocation and a denial of service DoS attack to be executed by sending a properly crafted request to the server. Such a request causes the program to enter an infinite loop. This issue...

DEBIAN-CVE-2023-4540

Improper Handling of Exceptional Conditions vulnerability in Daurnimator lua-http library allows Excessive Allocation and a denial of service DoS attack to be executed by sending a properly crafted request to the server. Such a request causes the program to enter an infinite loop. This issue...