PT-2021-27123

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.222 Description The issue is related to the rx owner map depending on pg vec in the net/packet component. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2021-27122

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.222 Description The issue is related to the netdevsim module in the Linux Kernel, where memory for new map's value is not properly zero-initialized in the function nsim bpf map alloc. This could potentially...

Rust 安全漏洞

Rust, a general-purpose, compiled programming language from the Mozilla Foundation, has a security vulnerability in versions prior to Rust ckb crate 0.40.0 that stems from an inability to allocate memory for misbehavior HashMap. An attacker could exploit this vulnerability to cause a denial of...

py39-unicorn -- sandbox escape and arbitrary code execution vulnerability

jwang-a reports: An issue was discovered in splitregion in uc.c in Unicorn Engine before 2.0.0-rc5. It allows local attackers to escape the sandbox. An attacker must first obtain the ability to execute crafted code in the target sandbox in order to exploit this vulnerability. The specific flaw...

PT-2021-24036

Name of the Vulnerable Software and Affected Versions: Unicorn Engine versions prior to 2.0.0-rc5 Description: The issue is related to the virtual memory manager, specifically in the split region function in uc.c. It allows local attackers to escape the sandbox by exploiting a faulty comparison o...

OESA-2021-1474 log4j security update

Log4j is a tool to help the programmer output log statements to a variety of output targets. Security Fixes: Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Threa...

Security Bulletin: Multiple vulnerabilities in Apache log4j affect the IBM WebSphere Application Server which is shipped with IBM Intelligent Operations Center (CVE-2021-4104, CVE-2021-45046).

Summary IBM WebSphere® Application Server is shipped with IBM® Intelligent Operations Center. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details CVEID: CVE-2021-4104 DESCRIPTION: Apache Log4j could...

PT-2021-27970

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN READ. The crash state includes functions such as mls semantic level expand, policydb user cache, and hashta...

VulnCheck KEV: CVE-2021-45105

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 and 2.3.1 did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue wa...

Updated log4j packages fix security vulnerability

Updated log4j packages fix security vulnerability: Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is...

Third Log4J Bug Can Trigger DoS; Apache Issues Patch

No, you’re not seeing triple: On Friday, Apache released yet another patch – version 2.17 – for yet another flaw in the ubiquitous log4j logging library, this time for a DoS bug. Trouble comes in threes, and this is the third one for log4j. The latest bug isn’t a variant of the Log4Shell...

SUSE-RU-2021:4127-1 Recommended update for samba

This update for samba fixes the following issues: The username map advice from the CVE-2020-25717 advisory note has undesired side effects for the local nt token. Fallback to a SID/UID based mapping if the name based lookup fails bsc1192849...

SUSE-RU-2021:4117-1 Recommended update for samba

This update for samba fixes the following issues: The username map advice from the CVE-2020-25717 advisory note has undesired side effects for the local nt token. Fallback to a SID/UID based mapping if the name based lookup fails bsc1192849...

Updated log4j packages fix security vulnerability

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map MDC input data when the logging configuration uses a non-default Pattern Layout with either a Context...

PT-2021-27004

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.6 Description The issue is related to the sizing of vsi-txq map in the ice driver. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

CVE-2021-45105

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 and 2.3.1 did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue wa...

Debian DSA-5024-1 : apache-log4j2 - security update

The remote Debian 10 / 11 host has a package installed that is affected by a vulnerability as referenced in the dsa-5024 advisory. It was found that Apache Log4j2, a Logging Framework for Java, did not protect from uncontrolled recursion from self-referential lookups. When the logging configurati...

PT-2021-26941

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.83 Description The issue is related to the sizing of vsi-txq map in the ice fix. The actual impact and attack plausibility have not yet been proven. It was introduced in version v5.5 and fixed in Linux Kern...

Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in...

Code injection

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 and 2.3.1 did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue wa...