Out-of-bounds

Industrial Control Systems Network Protocol Parsers ICSNPP - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds write in their primary analyses function for Ethercat communication packets. This could allow an attacker to cause arbitrary code execution...

CVE-2023-7242 Ethercat Zeek Plugin Out-of-bounds Read

Industrial Control Systems Network Protocol Parsers ICSNPP - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds read during the process of analyzing a specific Ethercat packet. This could allow an attacker to crash the Zeek process and leak some information in memory...

CVE-2023-7242

CVE-2023-7242 affects the ICSNPP Ethercat Zeek Plugin for Zeek (versions d78dda6 and prior). The vulnerability is an out-of-bounds read in the Ethercat packet analysis path, which can crash the Zeek process and may leak information in memory. Mitigation: update to commit 3bca34c or later. ICS adv...

CVE-2023-7242 Ethercat Zeek Plugin Out-of-bounds Read

Industrial Control Systems Network Protocol Parsers ICSNPP - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds read during the process of analyzing a specific Ethercat packet. This could allow an attacker to crash the Zeek process and leak some information in memory...

CVE-2023-7243 Ethercat Zeek Plugin Out-of-bounds Write

Industrial Control Systems Network Protocol Parsers ICSNPP - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds write while analyzing specific Ethercat datagrams. This could allow an attacker to cause arbitrary code execution...

CVE-2023-7244 Ethercat Zeek Plugin Out-of-bounds Write

Industrial Control Systems Network Protocol Parsers ICSNPP - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds write in their primary analyses function for Ethercat communication packets. This could allow an attacker to cause arbitrary code execution...

golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests

A flaw was found in the Golang net/http/internal package. This issue may allow a malicious user to send an HTTP request and cause the receiver to read more bytes from network than are in the body up to 1GiB, causing the receiver to fail reading the response, possibly leading to a Denial of Servic...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-519)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-519 advisory. 2024-12-05: CVE-2024-35839 was added to this advisory. 2024-12-05: CVE-2023-52683 was added to this advisory. 2024-12-05: CVE-2023-52693 was added to this advisory. 2024-12-05: CVE-2023-52679 w...

SUSE SLES15 Security Update : kernel (SUSE-SU-2024:0476-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0476-1 advisory. The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: -...

SUSE CVE-2023-46838

Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides a certain initial portion of the to be transferred data, these parts are directly translate...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-510)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-510 advisory. A flaw has been found in Xen. An unprivileged guest can cause Denial of Service DoS of the host by sending network packets to the backend, causing the backend to crash. CVE-2023-46838 A Null...

Fedora 39 : kernel (2024-50ab089b1d)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-50ab089b1d advisory. The 6.6.14 stable kernel update contains a number of important fixes across the tree. Tenable has extracted the preceding description block directly...

Fedora 38 : kernel (2024-0f89e13079)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-0f89e13079 advisory. The 6.6.14 stable kernel update contains a number of important fixes across the tree. Tenable has extracted the preceding description block directly...

kernel: sctp: fix a potential overflow in sctp_ifwdtsn_skip

In the Linux kernel, the following vulnerability has been resolved: sctp: fix a potential overflow in sctpifwdtsnskip Currently, when traversing ifwdtsn skips with sctpwalkifwdtsn, it only checks the pos against the end of the chunk. However, the data left for the last pos may be sizeofstruct...

ALPINE-CVE-2023-46838

Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides a certain initial portion of the to be transferred data, these parts are directly translate...

CVE-2023-46838

Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides a certain initial portion of the to be transferred data, these parts are directly translate...

AZL-34016 CVE-2023-46838 affecting package kernel for versions less than 5.15.153.1-1

Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides a certain initial portion of the to be transferred data, these parts are directly translate...

UBUNTU-CVE-2023-46838

Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides a certain initial portion of the to be transferred data, these parts are directly translate...

CVE-2023-46838 Linux: netback processing of zero-length transmit fragment

Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides a certain initial portion of the to be transferred data, these parts are directly translate...

CVE-2023-46838

CVE-2023-46838 affects Xen’s virtualization networking path where multi‑part transmitted requests can include zero‑length parts. If all parts of an SKB are zero length, the Linux networking code may dereference NULL, potentially enabling local or guest‑to‑host disruption. Public advisories ( Xen/...