Important: httpd

Issue Overview: Encoding problem in modproxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue...

DEBIAN-CVE-2024-38536

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. A memory allocation failure due to http.memcap being reached leads to a NULL-ptr reference leading to a crash. Upgrade to 7.0.6...

SUSE CVE-2021-47593

In the Linux kernel, the following vulnerability has been resolved: mptcp: clear 'kern' flag from fallback sockets The mptcp ULP extension relies on sk-sksockkern being set correctly: It prevents setsockoptfd, IPPROTOTCP, TCPULP, "mptcp", 6; from working for plain tcp sockets any userspace-expose...

AZL-42496 CVE-2024-36893 affecting package kernel for versions less than 5.15.176.3-1

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Check for port partner validity before consuming it typecregisterpartner does not guarantee partner registration to always succeed. In the event of failure, port-partner is set to the error value or NULL. Given...

SUSE CVE-2021-47471

In the Linux kernel, the following vulnerability has been resolved: drm: mxsfb: Fix NULL pointer dereference crash on unload The mxsfb-crtc.funcs may already be NULL when unloading the driver, in which case calling mxsfbirqdisable via drmirquninstall from mxsfbunload leads to NULL pointer...

DEBIAN-CVE-2023-52849

In the Linux kernel, the following vulnerability has been resolved: cxl/mem: Fix shutdown order Ira reports that removing cxlmockmem causes a crash with the following trace: BUG: kernel NULL pointer dereference, address: 0000000000000044 .. RIP: 0010:cxlregiondecodereset+0x7f/0x180 cxlcore .. Cal...

UBUNTU-CVE-2024-35907

In the Linux kernel, the following vulnerability has been resolved: mlxbfgige: call requestirq after NAPI initialized The mlxbfgige driver encounters a NULL pointer exception in mlxbfgigeopen when kdump is enabled. The sequence to reproduce the exception is as follows: a enable kdump b trigger...

OESA-2024-1593 glibc security update

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational...

SUSE-SU-2024:1675-1 Security update for glibc

This update for glibc fixes the following issues: - nscd: Fixed use-after-free in addgetnetgrentX BZ 23520 - CVE-2024-33599: nscd: Fixed Stack-based buffer overflow in netgroup cache bsc1223423, BZ 31677 - CVE-2024-33600: nscd: Avoid null pointer crashes after notfound response bsc1223424, BZ 316...

OESA-2024-1544 glibc security update

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational...

nscd: Null pointer crashes after notfound response

...

DEBIAN-CVE-2024-33600

nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's nscd cache fails to add a not-found netgroup response to the cache, the client request can result in a null pointer dereference. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This...

AZL-40425 CVE-2024-26984 affecting package hyperv-daemons for versions less than 5.15.158.1-1

In the Linux kernel, the following vulnerability has been resolved: nouveau: fix instmem race condition around ptr stores Running a lot of VK CTS in parallel against nouveau, once every few hours you might see something like this crash. BUG: kernel NULL pointer dereference, address:...

CVE-2024-26874

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix a null pointer crash in mtkdrmcrtcfinishpageflip It's possible that mtkcrtc-event is NULL in mtkdrmcrtcfinishpageflip. pendingneedsvblank value is set by mtkcrtc-event, but in mtkdrmcrtcatomicflush, it's is not...

DEBIAN-CVE-2024-26874

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix a null pointer crash in mtkdrmcrtcfinishpageflip It's possible that mtkcrtc-event is NULL in mtkdrmcrtcfinishpageflip. pendingneedsvblank value is set by mtkcrtc-event, but in mtkdrmcrtcatomicflush, it's is not...

CVE-2024-26874 drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix a null pointer crash in mtkdrmcrtcfinishpageflip It's possible that mtkcrtc-event is NULL in mtkdrmcrtcfinishpageflip. pendingneedsvblank value is set by mtkcrtc-event, but in mtkdrmcrtcatomicflush, it's is not...

SUSE CVE-2024-26607

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: sii902x: Fix probing race issue A null pointer dereference crash has been observed rarely on TI platforms using sii9022 bridge: 53.271356 sii902xgetedid+0x34/0x70 sii902x 53.276066 sii902xbridgegetedid+0x14/0x20 sii90...

AZL-55250 CVE-2024-26607 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: sii902x: Fix probing race issue A null pointer dereference crash has been observed rarely on TI platforms using sii9022 bridge: 53.271356 sii902xgetedid+0x34/0x70 sii902x 53.276066 sii902xbridgegetedid+0x14/0x20 sii90...

UBUNTU-CVE-2024-26607

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: sii902x: Fix probing race issue A null pointer dereference crash has been observed rarely on TI platforms using sii9022 bridge: 53.271356 sii902xgetedid+0x34/0x70 sii902x 53.276066 sii902xbridgegetedid+0x14/0x20 sii90...

AZL-35086 CVE-2024-0727 affecting package openssl for versions less than 1.1.1k-29

Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates...