OESA-2024-2365 dcraw security update

This package contains dcraw, a command line tool to decode raw image data downloaded from digital cameras. Security Fixes: CVE-2017-13735 CVE-2017-14608 A stack-based buffer overflow in the findgreen function of dcraw through 9.28, as used in ufraw-batch and many other products, may allow a remot...

OESA-2024-2366 dcraw security update

This package contains dcraw, a command line tool to decode raw image data downloaded from digital cameras. Security Fixes: CVE-2017-13735 CVE-2017-14608 A stack-based buffer overflow in the findgreen function of dcraw through 9.28, as used in ufraw-batch and many other products, may allow a remot...

CVE-2024-50140 sched/core: Disable page allocation in task_tick_mm_cid()

In the Linux kernel, the following vulnerability has been resolved: sched/core: Disable page allocation in tasktickmmcid With KASAN and PREEMPTRT enabled, calling taskworkadd in tasktickmmcid may cause the following splat. 63.696416 BUG: sleeping function called from invalid context at...

CVE-2019-20460

An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. POST requests don't require anti-CSRF tokens or other mechanisms for validating that the request is from a legitimate source. In addition, CSRF attacks can be used to send text directly to the RAW printer interface. For...

CVE-2019-20460: Cross-Site Request Forgery (CSRF)

An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. POST requests don't require anti-CSRF tokens or other mechanisms for validating that the request is from a legitimate source. In addition, CSRF attacks can be used to send text directly to the RAW printer interface. For...

CVE-2019-20460

An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. POST requests don't require anti-CSRF tokens or other mechanisms for validating that the request is from a legitimate source. In addition, CSRF attacks can be used to send text directly to the RAW printer interface. For...

PT-2024-10736 · Epson · Epson Expression Home Xp255

Name of the Vulnerable Software and Affected Versions: Epson Expression Home XP255 version 20.08.FM10I8 Description: An issue was discovered where POST requests do not require anti-CSRF tokens or other mechanisms for validating that the request is from a legitimate source. This allows for CSRF...

SUSE CVE-2024-50138

In the Linux kernel, the following vulnerability has been resolved: bpf: Use rawspinlockt in ringbuf The function bpfringbufreserve is invoked from a tracepoint, which disables preemption. Using spinlockt in this context can lead to a "sleep in atomic" warning in the RT variant. This issue is...

Linux SMB decrypt_raw_data() Buffer Overflow

The vulnerability of the decryptrawdata function in the fs/smb/client/smb2ops.c module of the SMB subsystem of the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...

AZL-52447 CVE-2024-50138 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Use rawspinlockt in ringbuf The function bpfringbufreserve is invoked from a tracepoint, which disables preemption. Using spinlockt in this context can lead to a "sleep in atomic" warning in the RT variant. This issue is...

AZL-52423 CVE-2024-50138 affecting package kernel for versions less than 6.6.85.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Use rawspinlockt in ringbuf The function bpfringbufreserve is invoked from a tracepoint, which disables preemption. Using spinlockt in this context can lead to a "sleep in atomic" warning in the RT variant. This issue is...

UBUNTU-CVE-2024-50138

In the Linux kernel, the following vulnerability has been resolved: bpf: Use rawspinlockt in ringbuf The function bpfringbufreserve is invoked from a tracepoint, which disables preemption. Using spinlockt in this context can lead to a "sleep in atomic" warning in the RT variant. This issue is...

PT-2024-37013

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A discrepancy exists between the reality that raw tracepoint arguments can be NULL and the verifier's knowledge that they are never NULL, causing explicit NULL checks to be deleted and...

PT-2024-35679

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a possible null pointer dereference in the cpufreq cpu get raw function. This function may return NULL if the CPU is not in the policy-cpus CPU mask, leading to a...

SUSE CVE-2022-49032

In the Linux kernel, the following vulnerability has been resolved: iio: health: afe4404: Fix oob read in afe4404read|writeraw KASAN report out-of-bounds read as follows: BUG: KASAN: global-out-of-bounds in afe4404readraw+0x2ce/0x380 Read of size 4 at addr ffffffffc00e4658 by task cat/278 Call...

PT-2024-34064

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.61 Description: A division by zero issue has been identified in the Linux kernel, specifically in the ad7124 set channel odr function. This occurs when the val parameter in the ad7124 write raw function is...

DEBIAN-CVE-2022-49031

In the Linux kernel, the following vulnerability has been resolved: iio: health: afe4403: Fix oob read in afe4403readraw KASAN report out-of-bounds read as follows: BUG: KASAN: global-out-of-bounds in afe4403readraw+0x42e/0x4c0 Read of size 4 at addr ffffffffc02ac638 by task cat/279 Call Trace:...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an out-of-bounds read issue in the afe4404read|writeraw function that could allow an attacker to read...

Critical Kubernetes Image Builder Vulnerability Exposes Nodes to Root Access Risk

A critical security flaw has been disclosed in the Kubernetes Image Builder that, if successfully exploited, could be abused to gain root access under certain circumstances. The vulnerability, tracked as CVE-2024-9486 CVSS score: 9.8, has been addressed in version 0.1.38. The project maintainers...

Denial of Service (DoS)

Overview org.webjars.npm:pacote is a JavaScript package downloader Affected versions of this package are vulnerable to Denial of Service DoS via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s rege...