kernel: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats()

A vulnerability was found in the Linux kernel's qla2xxx SCSI driver, specifically in the qlaedifappgetstats function, where an off-by-one error in array access could lead to memory corruption. This issue affects the appreply-elem array, where an incorrect comparison allowed out-of-bounds access...

DuckDB 安全漏洞

DuckDB is an in-process SQL OLAP database management system from DuckDB open source. A security vulnerability exists in DuckDB 1.0.0 and earlier versions, which stems from the ability of sniffcsv to provide file system access even when enableexternalaccess is disabled, which could allow an attack...

EDK2: integer overflow in CreateHob() could lead to HOB OOB R/W

A flaw was found in the CreateHob function in EDK2. An attacker, leveraging a local network, can initiate an integer overflow leading to a buffer overflow. This issue arises during size alignment within the CreateHob function, requiring activation in the PEI phase. Successful exploitation of this...

EulerOS Virtualization 2.10.1 : libvirt (EulerOS-SA-2024-2015)

According to the versions of the libvirt package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the...

kernel: octeontx2-af: avoid off-by-one read from userspace

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: avoid off-by-one read from userspace We try to access count + 1 byte from userspace with memdupuserbuffer, count + 1. However, the userspace only provides buffer of count bytes and only these count bytes are verifie...

DEBIAN-CVE-2022-48800

In the Linux kernel, the following vulnerability has been resolved: mm: vmscan: remove deadlock due to throttling failing to make progress A soft lockup bug in kcompactd was reported in a private bugzilla with the following visible in dmesg; watchdog: BUG: soft lockup - CPU33 stuck for 26s!...

Updated netatalk packages fix security vulnerabilities

Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibufPASSWDLEN to '\0' in FPLoginExt in login in etc/uams/uamspam.c. CVE-2024-38439 Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation...

UBUNTU-CVE-2024-39488

In the Linux kernel, the following vulnerability has been resolved: arm64: asm-bug: Add .align 2 to the end of BUGENTRY When CONFIGDEBUGBUGVERBOSE=n, we fail to add necessary padding bytes to bugtable entries, and as a result the last entry in a bug table will be ignored, potentially leading to a...

CBL Mariner 2.0 Security Update: libvirt (CVE-2024-1441)

The version of libvirt installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-1441 advisory. - An off-by-one error flaw was found in the udevListInterfacesByStatus function in libvirt when the number of...

CVE-2024-39894

OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry e.g., for su and Sudo because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur...

CLSA-2024-1719933179 kernel: Fix of 20 CVEs

net: iptunnel: make sure to pull inner header in iptunnelrcv CVE-2024-26882 - net: Set true network header for ECN decapsulation CVE-2024-26882 - media: dvb-core: Fix use-after-free due to race at dvbregisterdevice CVE-2022-45884 - media: dvbdev: fix error logic at dvbregisterdevice...

CVE-2024-39894

OpenSSH versions 9.5 through 9.7 before 9.8 are vulnerable to a timing attack against echo-off password entry (e.g., for su and Sudo ) due to an ObscureKeystrokeTiming logic error. This flaw allows a passive observer to detect real keystrokes and infer transmitted characters via packet timing. Af...

CVE-2024-39894

OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry e.g., for su and Sudo because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur...

Updated ffmpeg packages fix security vulnerabilities

Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the setencoderid function in /fftools/ffmpegenc.c component. CVE-2023-50010 Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary...

An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0 results in a write out of bound which allows an attacker to execute arbitrary code Denial of Service or other unspecified impacts.

...

Glibc: off-by-one heap-based buffer overflow in __vsyslog_internal()

...

Libvirt: off-by-one error in udevlistinterfacesbystatus()

...

kernel: octeontx2-af: avoid off-by-one read from userspace

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: avoid off-by-one read from userspace We try to access count + 1 byte from userspace with memdupuserbuffer, count + 1. However, the userspace only provides buffer of count bytes and only these count bytes are verifie...

kernel: octeontx2-af: avoid off-by-one read from userspace

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: avoid off-by-one read from userspace We try to access count + 1 byte from userspace with memdupuserbuffer, count + 1. However, the userspace only provides buffer of count bytes and only these count bytes are verifie...

SUSE SLES15 Security Update : kernel (Live Patch 10 for SLE 15 SP5) (SUSE-SU-2024:2207-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2207-1 advisory. This update for the Linux Kernel 5.14.21-1505005549 fixes several issues. The following security issues were fixed: - CVE-2024-26852: Fixed...