CVE-2024-57892

CVE-2024-57892 relates to the Linux kernel OCFS2 quota handling. The issue is a slab-use-after-free when remounting an ocfs2 filesystem as read-only and a quota_getnextquota syscall is used. The root cause is a dangling dqi_priv pointer that is freed during remount but not cleared, combined with ...

CVE-2024-57892 ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix slab-use-after-free due to dangling pointer dqipriv When mounting ocfs2 and then remounting it as read-only, a slab-use-after-free occurs after the user uses a syscall to quotagetnextquota. Specifically, sbdqinfosb,...

CVE-2024-27778

An improper neutralization of special elements used in an OS Command vulnerability CWE-78 vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0....

CVE-2024-43705

CVE-2024-43705 affects Imagination Technologies PowerVR-GPU (Imagination GPU Driver). The issue stems from a vulnerability in the GPU kernel driver where PVRSRVBridgePhysmemWrapExtMem can write to arbitrary read-only system files mapped into application memory, allowing a non-privileged user to p...

CVE-2024-43705 GPU DDK - Security: Exploitable PVRSRVBridgePhysmemWrapExtMem may lead to overwrite read-only file/memory (e.g. libc.so)

Software installed and run as a non-privileged user can trigger the GPU kernel driver to write to arbitrary read-only system files that have been mapped into application memory...

CVE-2024-43705 GPU DDK - Security: Exploitable PVRSRVBridgePhysmemWrapExtMem may lead to overwrite read-only file/memory (e.g. libc.so)

Software installed and run as a non-privileged user can trigger the GPU kernel driver to write to arbitrary read-only system files that have been mapped into application memory...

Imagination GPU Driver 安全漏洞

Imagination GPU Driver is a graphics driver from Imagination. A security vulnerability exists in Imagination GPU Driver versions 1.13 RTM through 24.2 RTM2, which originates from software installed and run as an unprivileged user can trigger the GPU kernel driver to write to arbitrary read-only...

PT-2024-30631 · Imagination Technologies · Graphics Ddk

Name of the Vulnerable Software and Affected Versions: No specific software name or versions are mentioned in the provided descriptions. Description: The issue allows software installed and run as a non-privileged user to trigger the GPU kernel driver to write to arbitrary read-only system files...

CVE-2024-53214 vfio/pci: Properly hide first-in-list PCIe extended capability

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Properly hide first-in-list PCIe extended capability There are cases where a PCIe extended capability should be hidden from the user. For example, an unknown capability i.e., capability with ID greater than PCIEXTCAPIDM...

CVE-2024-12582

A flaw was found in the skupper console, a read-only interface that renders cluster network, traffic details, and metrics for a network application that a user sets up across a hybrid multi-cloud environment. When the default authentication method is used, a random password is generated for the...

vdo bug fix update

An update is available for vdo. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The vdo packages provide Virtual Data Optimizer VDO, which is a block...

The vulnerability of AMD’s microprogrammed software for processors lies in the violation of data protection mechanisms, allowing attackers to circumvent the SPI ROM protection mechanism.

The vulnerability of AMD’s microprogrammed software lies in the bypass of the data protection mechanism. Exploiting this vulnerability allows an attacker to circumvent the SPI ROM protection mechanism by modifying the data...

PT-2024-29789 · Hcl · Hcl Bigfix Inventory

Name of the Vulnerable Software and Affected Versions: HCL BigFix Inventory affected versions not specified Description: The issue is related to an improper handling of insufficient permissions or privileges in HCL BigFix Inventory. An attacker with access via a read-only account can possibly...

OESA-2024-2533 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use two-phase skb reclamation in ieee80211dostop Since 'devqueuexmit' should be called with interrupts enabled, the following backtrace:...

OESA-2024-2536 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use two-phase skb reclamation in ieee80211dostop Since 'devqueuexmit' should be called with interrupts enabled, the following backtrace:...

Improper Authorization

Overview apache-superset is a modern, enterprise-ready business intelligence web application. Affected versions of this package are vulnerable to Improper Authorization through the SQLLab component. An attacker can execute unauthorized write operations by crafting a specially designed SQL DML...

CVE-2024-54494

A race condition was addressed with additional validation. This issue is fixed in iPadOS 17.7.3, watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An attacker may be able to create a read-only memory mapping that can be...

Apache Superset 安全漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A security vulnerability exists in Apache Superset versions prior to 4.1.0 that stems from improper authorization, which allows an attacker with SQLLab access to construct specially crafted SQL D...

CVE-2024-50558

A vulnerability has been identified in RUGGEDCOM RM1224 LTE4G EU 6GK6108-4AM00-2BA2 All versions V8.2, RUGGEDCOM RM1224 LTE4G NAM 6GK6108-4AM00-2DA2 All versions V8.2, SCALANCE M804PB 6GK5804-0AP00-2AA2 All versions V8.2, SCALANCE M812-1 ADSL-Router 6GK5812-1AA00-2AA2 All versions V8.2, SCALANCE...

kernel: md: Don't ignore read-only array in md_check_recovery()

In the Linux kernel, the following vulnerability has been resolved: md: Don't ignore read-only array in mdcheckrecovery The Linux kernel CVE team has assigned CVE-2024-26757 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040304-CVE-2024-26757-7f96@gregkh/T...