SUSE SLES12: kernel-azure / kernel-azure-base / kernel-azure-devel / etc (SUSE-SU-2022:3282-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3282-1 advisory. The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes. The following security bugs wer...

PT-2022-33628

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.19.2 Description The issue is related to the use of smp processor id in a preemptible context in the kexec functionality of the RISC-V architecture. The actual impact and attack plausibility have not yet been...

nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes

A regular expression denial of service ReDoS vulnerability was found in nodejs-ansi-regex. This could possibly cause an application using ansi-regex to use an excessive amount of CPU time when matching crafted ANSI escape codes...

CVE-2022-39810

An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting XSS vulnerability has been identified in the Management Console under /carbon/ndatasource/validateconnection/ajaxprocessor.jsp via the driver parameter. Session hijacking or similar attacks would not be...

CVE-2022-39810

An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting XSS vulnerability has been identified in the Management Console under /carbon/ndatasource/validateconnection/ajaxprocessor.jsp via the driver parameter. Session hijacking or similar attacks would not be...

WSO2 Enterprise Integrator Cross-Site Scripting Vulnerability

WSO2 Enterprise Integrator is the United States WSO2 company's set of open source hybrid integration platform. The platform supports communication between multiple applications. A security vulnerability exists in WSO2 Enterprise Integrator version 6.4.0, which is caused by a reflected cross-site...

Linux POSIX CPU Core Code Execution

The vulnerability of the POSIX CPU core component in the Linux operating system is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

OSV-2022-854 Heap-buffer-overflow in perfetto::trace_processor::TrackEventParser::ParseTrackDescriptor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51022 Crash type: Heap-buffer-overflow WRITE 4 Crash state: perfetto::traceprocessor::TrackEventParser::ParseTrackDescriptor perfetto::traceprocessor::TrackEventModule::ParsePacket...

perfetto:trace_processor_fuzzer: Heap-buffer-overflow in perfetto::trace_processor::TrackEventParser::ParseTrackDescriptor

Project: https://android.googlesource.com/platform/external/perfetto/ Detailed Report: https://oss-fuzz.com/testcase?key=5403636523466752 Project: perfetto Fuzzing Engine: libFuzzer Fuzz Target: traceprocessorfuzzer Job Type: libfuzzerasanperfetto Platform Id: linux Crash Type: Heap-buffer-overfl...

A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports Secure Encrypted Virtualization (SEV).

...

CVE-2021-35132

Out of bound write in DSP service due to improper bound check for response buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables...

PT-2022-10445 · Qualcomm · Snapdragon

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon affected versions not specified Description: The issue is related to an out of bound write in the DSP service due to an improper bound check for the response buffer size. This affects various Qualcomm Snapdragon products,...

mariadb: server crash in Item_func_in::cleanup/Item::cleanup_processor

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Itemfuncin::cleanup/Item::cleanupprocessor...

CVE-2022-36059

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data...

SUSE: Security Advisory (SUSE-SU-2022:2960-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2022:2960-1 Security update for ucode-intel

This update for ucode-intel fixes the following issues: Updated to Intel CPU Microcode 20220809 release bsc1201727: - CVE-2022-21233: Fixed an issue where stale data may have been leaked from the legacy xAPIC MMIO region, which could be used to compromise an SGX enclave INTEL-SA-00657. See also:...

HPESBHF04344 rev.1 - Certain HPE Apollo, XL Servers Using Certain Intel Processors, INTEL-SA-00657, 2022.2 IPU - Intel Processor Advisory, Local Disclosure of Information

Potential Security Impact: Local: Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant XL220n Gen10 Plus Server - Prior to 1.6408-11-2022 HPE ProLiant XL290n Gen10 Plus Server - Prior to 1.6408-11-2022 HPE Apollo 2000 Gen10 Plus System - Prior to...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the KVM SEV API that allows a non-root host user-level application to crash the host kernel by creating an...

Ubuntu: Security Advisory (USN-4182-4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-390-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...