CVE-2024-47543 GHSL-2024-236: GStreamer has an OOB-read in qtdemux_parse_container

GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in qtdemuxparsecontainer function within qtdemux.c. In the parent function qtdemuxparsenode, the value of length is not well checked. So, if length is big enough, it causes t...

kernel: arm64: probes: Remove broken LDR (literal) uprobe support

In the Linux kernel, the following vulnerability has been resolved: arm64: probes: Remove broken LDR literal uprobe support The simulateldrliteral and simulateldrswliteral functions are unsafe to use for uprobes. Both functions were originally written for use with kprobes, and access memory with...

PT-2024-10372

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description The issue is related to an out-of-bounds OOB read in the qtdemux parse svq3 stsd data function within qtdemux.c. Specifically, in the FOURCC SMI case, seqh size is read from the input file withou...

Vulnerability of RDMA/siw components of Linux operating system cores, allowing attackers to cause service interruptions

The vulnerability of RDMA/siw components of the Linux operating system’s kernel is related to the lack of memory release after the effective lifespan of these components. Exploiting this vulnerability can allow an attacker to cause a service failure...

Amazon Linux 2022 : vim-common, vim-data, vim-default-editor (ALAS2022-2022-023)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-023 advisory. A flaw was found in vim. The vulnerability occurs due to too many recursions, which can lead to a segmentation fault. This flaw allows an attacker to input a specially crafted file, leading to ...

ARM多款产品 安全漏洞

The ARM Cortex-A77, among others, is a central processing unit from the British company ARM. A security vulnerability exists in various Arm products, which stems from the possibility that memory accesses may be incorrectly converted. The following products are affected: ARM Cortex-A77, ARM...

CVE-2024-11991

Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few locations. This vulnerability could potentially allow unauthorized read or write access to a Canister's memory. However, exploiting this bug requires the...

CVE-2024-11991 Uninitialized memory access in Motoko incremental garbage collector

Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few locations. This vulnerability could potentially allow unauthorized read or write access to a Canister's memory. However, exploiting this bug requires the...

CVE-2024-11991

The CVE-2024-11991 entry concerns Motoko’s incremental garbage collector, where an uninitialized memory access arises from incorrect use of write barriers in a few locations. Documents confirm the vulnerability affects Motoko and that exploitation requires enabling non-default features (the incre...

PT-2024-17386 · Motoko · Motoko

Name of the Vulnerable Software and Affected Versions: Motoko affected versions not specified Description: The incremental garbage collector in Motoko is affected by an uninitialized memory access bug. This issue is caused by the incorrect use of write barriers in a few locations, potentially...

Motoko 安全漏洞

Motoko is a secure, simple, participant-based programming language open-sourced by DFINITY for building Internet Computer ICP jar smart contracts. Motoko has a security vulnerability that stems from the incremental garbage collector containing an uninitialized memory access error...

The vulnerability of the JxlEncoderAddJPEGFrame() function in the JPEG XL decoder library Libjxl allows a hacker to induce a service failure.

The vulnerability of the JxlEncoderAddJPEGFrame function in the JPEG XL decoder from the Libjxl library is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CLSA-2024-1733483945 Fix of 9 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-49992 - drm: remove all control node code - drm: add managed resources tied to drmdevice - drm: Set finalkfree in drmdevalloc - drm/plane: add drmmuniversalplanealloc - drm: Handle dev-unique with drmm - drm: Use drmm for drmdevinit cleanup - drm:...

CVE-2023-48010

STMicroelectronics SPC58 is vulnerable to Missing Protection Mechanism for Alternate Hardware Interface. Code running as Supervisor on the SPC58 PowerPC microcontrollers may disable the System Memory Protection Unit and gain unabridged read/write access to protected assets...

kernel: vt_ioctl: fix array_index_nospec in vt_setactivate

A vulnerability was found in the Linux kernel's vtioctl subsystem, where the vtsetactivate function can lead to a transient integer underflow due to improper handling of the vsa.console value. The vulnerability arises when an out-of-bounds value is decreased before being sanitized using...

kernel: cifs: fix oops during encryption

An out-of-bounds memory access vulnerability exists in the linux kernel, such that A stack-allocated buffer backed by vmalloc was passed into crypto code scatterwalkmapandcopy → memcpy where a cross-page write occurred. This ended up hitting a read-only mapping, causing a page-level fault and...

kernel: bpf: Fix overrunning reservations in ringbuf

An out-of-bounds memory access flaw was found in the Linux kernel’s BPF subsystem. This flaw allows a local user to crash the system...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a failure to properly handle dml allocation failures in the drm/amd/display driver, which could lead to a...

The vulnerability of the Linux operating system’s kernel’s phonetic component, which allows a hacker to trigger a service failure

The vulnerability of the Linux operating system’s kernel’s phonetic component is related to the operation of the operation outside the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the vdec component of MediaTek’s microprogramming software chips allows attackers to enhance their privileges.

The vulnerability of the vdec component of MediaTek’s microprogramming software lies in the execution of operations outside the buffer boundaries in memory. Exploiting this vulnerability can allow attackers to enhance their privileges...