SUSE CVE-2024-53085

In the Linux kernel, the following vulnerability has been resolved: tpm: Lock TPM chip in tpmpmsuspend first Setting TPMCHIPFLAGSUSPENDED in the end of tpmpmsuspend can be racy according, as this leaves window for tpmhwrngread to be called while the operation is in progress. The recent bug report...

AZL-53849 CVE-2024-53085 affecting package kernel for versions less than 6.6.64.2-9

In the Linux kernel, the following vulnerability has been resolved: tpm: Lock TPM chip in tpmpmsuspend first Setting TPMCHIPFLAGSUSPENDED in the end of tpmpmsuspend can be racy according, as this leaves window for tpmhwrngread to be called while the operation is in progress. The recent bug report...

DEBIAN-CVE-2024-53073

In the Linux kernel, the following vulnerability has been resolved: NFSD: Never decrement pendingasynccopies on error The error flow in nfsd4copy calls cleanupasynccopy, which already decrements nn-pendingasynccopies...

CVE-2024-53077 rpcrdma: Always release the rpcrdma_device's xa_array

In the Linux kernel, the following vulnerability has been resolved: rpcrdma: Always release the rpcrdmadevice's xaarray Dai pointed out that the xainitflags in rpcrdmaaddone needs to have a matching xadestroy in rpcrdmaremoveone to release underlying memory that the xarray might have accrued duri...

CVE-2024-50281

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation When sealing or unsealing a key blob we currently do not wait for the AEAD cipher operation to finish and simply return after submitting the request. If there is...

CVE-2024-50281

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation When sealing or unsealing a key blob we currently do not wait for the AEAD cipher operation to finish and simply return after submitting the request. If there is...

CVE-2024-50281 KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation When sealing or unsealing a key blob we currently do not wait for the AEAD cipher operation to finish and simply return after submitting the request. If there is...

CVE-2024-50281

CVE-2024-50281 affects the Linux kernel’s key management component, specifically the trusted: dcp path. The vulnerability stems from sealing/unsealing a key blob where the AEAD cipher operation is submitted but not waited for, allowing a race that can lead to a NULL pointer dereference in the DCP...

Virtuozzo Hybrid Infrastructure 6.3 Hotfix 1 (6.3.0-177)

This update provides stability and performance improvements. Vulnerability id: VSTOR-91833 A performance improvement. Vulnerability id: VSTOR-94382 Increased the number of Grafana dashboards that can be added to the Dashboard Directory. Vulnerability id: VSTOR-94508 In the admin panel, LUNs are n...

DEBIAN-CVE-2024-52522

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target...

The vulnerability of the Power Monitoring Expert, Power Operation, and Power SCADA Operation software allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the Power Monitoring Expert, Power Operation, and Power SCADA Operation software relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks from a remote location...

Virtuozzo Hybrid Infrastructure 6.1 Update 1 Hotfix 8 (6.1.1-61)

This update provides stability fixes. Vulnerability id: VSTOR-90793 Volume resize fails when the Nova API is not upgraded. Vulnerability id: VSTOR-94387 A stability fix for the S3 service. Vulnerability id: VSTOR-94519 When a VM is shelved by a host evacuation task, its attached PCI devices are n...

Virtuozzo Hybrid Infrastructure 6.2 Update 1 Hotfix 3 (6.2.1-68)

This update provides stability fixes. Vulnerability id: VSTOR-94508 In the admin panel, LUNs are not displayed for a new target group. Vulnerability id: VSTOR-94519 When a VM is shelved by a host evacuation task, its attached PCI devices are not released. Vulnerability id: VSTOR-94551 Failed to...

WordPress plugin Buy one click WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exis...

kernel: io_uring/sqpoll: work around a potential audit memory leak

In the Linux kernel, the following vulnerability has been resolved: iouring/sqpoll: work around a potential audit memory leak kmemleak complains that there's a memory leak related to connect handling: unreferenced object 0xffff0001093bdf00 size 128: comm "iou-sqp-455", pid 457, jiffies 4294894164...

kernel: serial: amba-pl011: avoid SBSA UART accessing DMACR register

A flaw was found in the Linux kernel’s AMBA-PL011 serial driver used on ARM Server Base System Architecture platforms. The existing stoprx operation shared between generic SBSA UARTs and AMBA-PL011 UARTs invoked pl011dmarxstop, which attempts to access the DMA Control Register DMACR. SBSA generic...

kernel: usb: cdc-wdm: close race between read and workqueue

No description is available for this CVE...

kernel: wifi: cfg80211: validate HE operation element parsing

A vulnerability was found in the Linux kernel's cfg80211 component, related to the parsing of HE operation elements, where the issue occurs when the length of the HE operation element is not validated before parsing, potentially leading to buffer overflows or undefined behavior...

kernel: cpu/hotplug: Don't offline the last non-isolated CPU

In the Linux kernel, the following vulnerability has been resolved: cpu/hotplug: Don't offline the last non-isolated CPU If a system has isolated CPUs via the "isolcpus=" command line parameter, then an attempt to offline the last housekeeping CPU will result in a WARNON when rebuilding the...

PT-2025-25867

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.10.137 Description A problem has been identified in the Linux kernel where a sleeping function is called from an invalid context. This issue occurs when the console lock function is called while holding a...