CVE-2024-26935

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix unremoved procfs host directory regression Commit fc663711b944 "scsi: core: Remove the /proc/scsi/$procname directory earlier" fixed a bug related to modules loading/unloading, by adding a call to scsiprochostdirr...

CVE-2024-26935

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix unremoved procfs host directory regression Commit fc663711b944 "scsi: core: Remove the /proc/scsi/$procname directory earlier" fixed a bug related to modules loading/unloading, by adding a call to scsiprochostdirr...

kernel: PM: hibernate: defer device probing when resuming from hibernation

In the Linux kernel, the following vulnerability has been resolved: PM: hibernate: defer device probing when resuming from hibernation syzbot is reporting hung task at miscopen 1, for there is a race window of AB-BA deadlock which involves probecount variable. Currently waitfordeviceprobe from...

kernel: bpf: bpf_sk_storage: Fix invalid wait context lockdep report

A locking context violation was found in the BPF socket local storage implementation in the Linux kernel. The code attempts to allocate memory via kzalloc while holding a rawspinlock, which is unsafe for PREEMPTRT kernels. This can cause lockdep warnings and potential issues on real-time kernels...

kernel: tracing: Fix sleeping function called from invalid context on RT kernel

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix sleeping function called from invalid context on RT kernel When setting bootparams="traceevent=initcall:initcallstart tpprintk=1" in the cmdline, the outputprintk was called, and the spinlockirqsave was called in the...

kernel: scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Use rawsmpprocessorid instead of smpprocessorid The following call trace was observed: localhost kernel: nvme nvme0: NVME-FC0: controller connect complete localhost kernel: BUG: using smpprocessorid in preemptible...

ALSA-2024:2137 Low: LibRaw security update

LibRaw is a library for reading RAW files obtained from digital photo cameras CRW/CR2, NEF, RAF, DNG, and others. Security Fixes: LibRaw: a heap-buffer-overflow in raw2imageex CVE-2023-1729 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...

PT-2024-13939 · Emdns · Emdns

Name of the Vulnerable Software and Affected Versions: emdns versions through fbd1eef Description: The issue arises from the emdns resolve raw function in emdns.c, which calls strlen with an input that may not be 0 terminated, leading to a stack-based buffer over-read. This can be triggered by a...

PYSEC-2024-208

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the createfromblueprint builtin can result in a double eval vulnerability when rawargs=True and the args argument has side-effects. It can be seen that the buildcreateIR function of t...

PYSEC-2024-206

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, incorrect values can be logged when rawlog builtin is called with memory or storage arguments to be used as topics. A contract search was performed and no vulnerable contracts were found in...

CVE-2024-32645 vyper performs incorrect topic logging in raw_log

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, incorrect values can be logged when rawlog builtin is called with memory or storage arguments to be used as topics. A contract search was performed and no vulnerable contracts were found in...

PT-2024-5591 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 5.1 through 17.0.6 GitLab versions 17.1 through 17.1.4 GitLab versions 17.2 through 17.2.2 Description: A cross-site scripting issue exists due to inadequate protection of the web page structure. This can be exploited by a...

PT-2024-24740 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions 0.3.10 and prior Description: Using the create from blueprint builtin can result in a double eval vulnerability when raw args=True and the args argument has side-effects. The build create IR function of the create from blueprin...

PT-2024-24738 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions 0.3.10 and prior Description: The issue arises when the raw log builtin is called with memory or storage arguments to be used as topics, resulting in incorrect values being logged. This is due to the build IR function of the...

Raw Disk Handler Privilege Escalation

The vulnerability of the Raw Disk Handler component in VMware Fusion relates to insecure management of privileges. Exploiting this vulnerability could allow an attacker to elevate their privileges to the root level...

[SECURITY] Fedora 38 Update: libopenmpt-0.7.6-1.fc38

libopenmpt is a cross-platform C++ and C library to decode tracked music files modules into a raw PCM audio stream. libopenmpt is based on the player code of the OpenMPT project Open ModPlug Tracker. In order to avoid code base fragmentation, libopenmpt is developed in the same source code...

CVE-2024-2047

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.6 via the renderraw function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files o...

PT-2024-18666 · WordPress · Elementskit Elementor Addons

Name of the Vulnerable Software and Affected Versions: ElementsKit Elementor addons plugin for WordPress versions up to, and including, 3.0.6 Description: The issue allows authenticated attackers with contributor-level access and above to include and execute arbitrary files on the server via the...

WordPress Plugin ElementsKit Elementor addons security vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

UBUNTU-CVE-2021-47178

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Avoid smpprocessorid in preemptible code The BUG message "BUG: using smpprocessorid in preemptible 00000000 code" was observed for TCMU devices with kernel config DEBUGPREEMPT. The message was observed when...