USN-6318-1: Linux kernel vulnerabilities

Daniel Moghimi discovered that some IntelR Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. CVE-2022-40982 Tavis Ormandy discovered that some AMD processors...

CLSA-2023-1693333574 Fix of 12 CVEs

CVE-url: https://ubuntu.com/security/CVE-2023-4128 - net/sched: clsu32: No longer copy tcfresult on update to avoid use-after- free - net/sched: clsfw: No longer copy tcfresult on update to avoid use-after- free - net/sched: clsroute: No longer copy tcfresult on update to avoid use- after-free...

hw: amd: Cross-Process Information Leak

A flaw was found in hw, in “Zen 2” CPUs. This issue may allow an attacker to access sensitive information under specific microarchitectural circumstances...

CVE-2023-36481

An issue was discovered in Samsung Exynos Mobile Processor and Wearable Processor 9810, 9610, 9820, 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, 9110, and W920. Improper handling of PPP length parameter inconsistency can cause an infinite loop...

Input validation

An issue was discovered in Samsung Exynos Mobile Processor and Wearable Processor 9810, 9610, 9820, 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, 9110, and W920. Improper handling of PPP length parameter inconsistency can cause an infinite loop...

CVE-2023-36481

An issue was discovered in Samsung Exynos Mobile Processor and Wearable Processor 9810, 9610, 9820, 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, 9110, and W920. Improper handling of PPP length parameter inconsistency can cause an infinite loop...

PT-2023-25587 · Samsung · Samsung Mobile Processor Exynos +1

Name of the Vulnerable Software and Affected Versions: Samsung Exynos Mobile Processor and Wearable Processor versions 9810, 9610, 9820, 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, 9110, W920 Description: An issue was discovered in Samsung Exynos Mobile Processor and Wearable Processor. Imprope...

CVE-2023-36481

CVE-2023-36481 affects Samsung Exynos Mobile Processor and Wearable Processor family (models 9810, 9610, 9820, 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, 9110, W920). The issue is due to improper handling of PPP length parameter inconsistency, which can cause an infinite loop. Connected source...

Vulnerability of Intel processor BIOS microprogramming software, allowing attackers to enhance their privileges

The vulnerability of Intel processor BIOS microprogramming software is related to insufficient verification of data entered by users. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the CMD_W_REG command processor in the CE_A protocol implementation of the CE805M data collection and transmission device allows a perpetrator to modify parameters so that commands of the operating system are executed during automatic updates of the application software.

The vulnerability of the CMDWREG command processor in the CEA protocol implementation of the CE805M device for data collection and transmission is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to modify parameters so that system commands are executed...

The vulnerability of the CMD_W_REG command processor in the CEAR_MWDI_DFLT_PASSWORD register of the CE805M data collection and transmission device allows a attacker to compromise the integrity of the database or cause service failures.

The vulnerability of the CMDWREG command processor in the CEARMWDIDFLTPASSWORD registry of the CE805M data collection and transmission device is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability could allow an attacker to compromise the...

CVE-2023-38666

Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4Processor::ProcessFragments function in mp4encrypt...

CVE-2023-20583

A power side-channel vulnerability was found in AMD processors. This issue may allow an authenticated attacker to monitor the CPU power consumption as the data in a cache line changes over time, resulting in a sensitive information leak. Mitigation Please contact HW vendor for more update on this...

webpki: CPU denial of service in certificate path building

When this crate is given a pathological certificate chain to validate, it will spend CPU time exponential with the number of candidate certificates at each step of path building. Both TLS clients and TLS servers that accept client certificate are affected. This was previously reported in and...

Bento4 安全漏洞

Bento4 is an open source C++ library for reading and writing MP4 files. A denial-of-service vulnerability exists in Bento4, which stems from the AP4Processor::ProcessFragments function in mp4crypt containing a segmentation violation that can be exploited by an attacker to cause a denial-of-servic...

Security News This Week: US Energy Firm Targeted With Malicious QR Codes in Mass Phishing Attack

New research reveals the strategies hackers use to hide their malware distribution system, and companies are rushing to release mitigations for the “Downfall” processor vulnerability on Intel chips...

CLSA-2023-1692295398 Update of microcode_ctl

Update Intel CPU microcode to microcode-20230512-rev.2 release: - Addition of 06-9a-04/0x40 microcode at revision 0x4; - Addition of 06-be-00/0x01 microcode at revision 0x10; - Update of 06-55-03/0x97 SKX-SP B1 microcode from revision 0x1000161 up to 0x1000171; - Update of 06-55-04/0xb7...

CVE-2023-39741

lrzip v0.651 was discovered to contain a heap overflow via the libzpaq::PostProcessor::writeint function at /libzpaq/libzpaq.cpp. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted file...

PT-2023-27098 · Lrzip +1 · Lrzip +1

Name of the Vulnerable Software and Affected Versions: lrzip version 0.651 Description: The issue is related to a heap overflow via the libzpaq::PostProcessor::writeint function at /libzpaq/libzpaq.cpp. This allows attackers to cause a Denial of Service DoS via a crafted file. Recommendations: Fo...

CLSA-2023-1692110278 microcode_ctl: Fix of CVE-2023-20593

Update AMD CPU microcode to 2023-07-19 addresses CVE-2023-20593: - Addition AMD CPU microcode for processor family 17h: sig 0x008a0f00; - Update AMD CPU microcode for processor family 19h: sig 0x00a00f10, sig 0x00a00f11, sig 0x00a00f12; - Update AMD CPU microcode for processor family 17h: sig...