kernel: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats()

A vulnerability was found in the Linux kernel's qla2xxx SCSI driver, specifically in the qlaedifappgetstats function, where an off-by-one error in array access could lead to memory corruption. This issue affects the appreply-elem array, where an incorrect comparison allowed out-of-bounds access...

Microsoft Detects Growing Use of File Hosting Services in Business Email Compromise Attacks

Microsoft is warning of cyber attack campaigns that abuse legitimate file hosting services such as SharePoint, OneDrive, and Dropbox that are widely used in enterprise environments as a defense evasion tactic. The end goal of the campaigns are broad and varied, allowing threat actors to compromis...

CVE-2024-9306

The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 10.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

PT-2024-33724

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.11.0+ Description: The issue is related to an off-by-one error in the alloc flex gd function in the ext4 filesystem. This error can cause the flex gd-resize bg to be bigger than flexbg size when adjusting resi...

Avast Antivirus 安全漏洞

Avast Antivirus is a suite of antivirus software from the Czech company Avast. A security vulnerability exists in versions prior to Avast Antivirus 24.1, which stems from a vulnerability that could allow a local attacker to elevate privileges via COM hijacking during the time of check to time of...

Synology DiskStation Manager Sudo Off-by-one Error (CVE-2021-3156)

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via sudoedit -s and a command-line argument that ends with a single backslash character. This plugin only works with Tenable.ot. Please visit...

September 30, 2024—KB5043178 (OS Build 26100.1882) Preview

None None...

SUSE CVE-2024-46852

In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix off-by-one in CMA heap fault handler Until VMDONTEXPAND was added in commit 1c1914d6e8c6 "dma-buf: heaps: Don't track CMA dma-buf pages under RssFile" it was possible to obtain a mapping larger than the buffer...

DEBIAN-CVE-2024-46852

In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix off-by-one in CMA heap fault handler Until VMDONTEXPAND was added in commit 1c1914d6e8c6 "dma-buf: heaps: Don't track CMA dma-buf pages under RssFile" it was possible to obtain a mapping larger than the buffer...

AZL-49837 CVE-2024-46852 affecting package kernel for versions less than 6.6.56.1-5

In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix off-by-one in CMA heap fault handler Until VMDONTEXPAND was added in commit 1c1914d6e8c6 "dma-buf: heaps: Don't track CMA dma-buf pages under RssFile" it was possible to obtain a mapping larger than the buffer...

AZL-49809 CVE-2024-46852 affecting package kernel for versions less than 5.15.176.3-1

In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix off-by-one in CMA heap fault handler Until VMDONTEXPAND was added in commit 1c1914d6e8c6 "dma-buf: heaps: Don't track CMA dma-buf pages under RssFile" it was possible to obtain a mapping larger than the buffer...

OESA-2024-2205 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: FFmpeg version n5.1 to...

OESA-2024-2204 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: FFmpeg version n5.1 to...

OESA-2024-2202 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: FFmpeg version n5.1 to...

Security Bulletin: Vulnerability in glibc affects IBM Integrated Analytics System [CVE-2021-3999]

Summary Redhat provided glibc is used by IBM Integrated Analytics System. IBM Integrated Analytics System has addressed the applicable CVE CVE-2021-3999 Vulnerability Details CVEID:CVE-2021-3999 DESCRIPTION: GNU glibc is vulnerable to an off-by-one buffer overflow and underflow, caused by imprope...

goTenna Pro 安全特征问题漏洞

goTenna Pro is a series of devices from goTenna that can create networks for off-grid communications and situational awareness. A security signature issue vulnerability exists in goTenna Pro that stems from not using strong random numbers when generating its cryptographic keys...

goTenna Pro 安全漏洞

goTenna Pro is a series of devices from goTenna that can create networks for off-grid communications and situational awareness. A security vulnerability exists in goTenna Pro versions 1.9.12 and earlier, which stems from an encryption key being stored with a static IV, which allows the key stored...

goTenna Pro 安全漏洞

goTenna Pro is a series of devices from goTenna that can create networks for off-grid communications and situational awareness. A security vulnerability exists in goTenna Pro that stems from the presence of a payload length vulnerability, which allows the length of the payload to be known...

goTenna Pro 授权问题漏洞

goTenna Pro is a series of devices from goTenna that can create networks for off-grid communication and situational awareness. An authorization issue vulnerability exists in goTenna Pro that stems from not authenticating the public key, which allows an unauthenticated attacker to intercept and...

goTenna Pro 安全漏洞

The goTenna Pro is a series of devices from goTenna that can create networks for off-grid communications and situational awareness. The goTenna Pro has a security vulnerability that stems from not encrypting its user's call sign...