UBUNTU-CVE-2021-46974

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix masking negation logic upon negative dst register The negation logic for the case where the offreg is sitting in the dst register is not correct given then we cannot just invert the add to a sub or vice versa. As a fix,...

gimp: psp off-by-one RCE

A parsing vulnerability was found in the GNU Image Manipulation Program GIMP. This flaw allows an unauthenticated, remote attacker to trick a GIMP user into opening a malicious PSP file, possibly enabling the execution of unauthorized code within the GIMP process...

GHSA-PX7W-C9GW-7GJ3 Apache James server: Privilege escalation via JMX pre-authentication deserialization

Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation. Note that by default JM...

Authentication flaw

Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation. Note that by default JM...

SUSE CVE-2024-27319

Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNXASSERT and ONNXASSERTM functions have an off by one string copy...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from incorrect negation logic for the case where offreg is located in the dst register...

Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions have an off by one string copy.

...

AZL-35148 CVE-2024-27319 affecting package pytorch for versions less than 2.2.2-1

Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNXASSERT and ONNXASSERTM functions have an off by one string copy...

PYSEC-2024-223

Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNXASSERT and ONNXASSERTM functions have an off by one string copy...

Open Neural Network Exchange Buffer Error Vulnerability

The Open Neural Network Exchange ONNX is an open ecosystem that enables AI developers to choose the right tools for their projects as they evolve. A buffer error vulnerability exists in Open Neural Network Exchange 1.15.0 and prior versions, which stems from the ONNXASSERT and ONNXASSERTM functio...

PT-2024-21818 · Onnx · Onnx

Name of the Vulnerable Software and Affected Versions: onnx versions prior to 1.15.0 Description: The issue is related to an Out-of-bounds Read in the onnx package. This occurs because the ONNX ASSERT and ONNX ASSERTM functions have an off-by-one string copy. Recommendations: For versions prior t...

AZL-35457 CVE-2023-52160 affecting package wpa_supplicant for versions less than 2.10-2

The implementation of PEAP in wpasupplicant through 2.10 allows authentication bypass. For a successful attack, wpasupplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eappeapdecrypt vulnerability can then be abused to skip Phase 2...

PT-2024-21493 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.8.0-rc4-syzkaller-00267-g0f1dd5e91e2b Description: A vulnerability has been resolved in the Linux kernel, specifically in the net subsystem, where a lockdep violation was reported by syzbot involving af unix...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-038)

The version of kernel installed on the remote host is prior to 5.15.148-97.161. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-038 advisory. A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to...

Important: kernel-livepatch-4.14.336-253.554

Issue Overview: An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 netfilter: nftables: Reject tables of unsupported family; While creating a new netfilter table, lack of a safeguard against invalid nftables family pf values within nftablesnewtable...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-517)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-517 advisory. In the Linux kernel, the following vulnerability has been resolved: drm: Don't unref the same fb many times by mistake due to deadlock handling CVE-2023-52486 In the Linux kernel, the following...

gimp: psp off-by-one RCE

A parsing vulnerability was found in the GNU Image Manipulation Program GIMP. This flaw allows an unauthenticated, remote attacker to trick a GIMP user into opening a malicious PSP file, possibly enabling the execution of unauthorized code within the GIMP process...

SUSE CVE-2024-24989

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3...

DEBIAN-CVE-2024-24989

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3...

Cyberattack on Democracy: Escalating Cyber Threats Immediately Ahead of Taiwan’s 2024 Presidential Election

Cyberattack on Democracy: Escalating Cyber Threats Immediately Ahead of Taiwan’s 2024 Presidential Election By Anne An · February 13, 2024 Preface Cybersecurity has become an integral part of election security. Nation-state actors and other politically motivated groups are likely to try to...