UBUNTU-CVE-2024-42238

In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Return error if block header overflows file Return an error from csdsppowerup if a block header is longer than the amount of data left in the file. The previous code in csdspload and csdsploadcoeff would loop whi...

DEBIAN-CVE-2023-52669

In the Linux kernel, the following vulnerability has been resolved: crypto: s390/aes - Fix buffer overread in CTR mode When processing the last block, the s390 ctr code will always read a whole block, even if there isn't a whole block of data left. Fix this by using the actual length left and cop...

Malicious code in wlwz-2312-6301 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c9777bec12419943d2eba94dd01bb4d12ad72e82627353fc463db4e6527691be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-339 Malicious code in wlwz-2312-1807 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9fd4e7e7097a33ed742fcf20bd3f997cfc4bc9a76408d9d52267db878ec4a242 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-1605 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 597b848ef0ae0330e6565d68a892dcd0b32526a2b37600f9f683f8d9da1368c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

kernel: md/raid10: fix leak of 'r10bio->remaining' for recovery

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix leak of 'r10bio-remaining' for recovery raid10syncrequest will add 'r10bio-remaining' for both rdev and replacement rdev. However, if the read io fails, recoveryrequestwrite returns without issuing the write io, in...

kernel: md/raid10: fix leak of 'r10bio->remaining' for recovery

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix leak of 'r10bio-remaining' for recovery raid10syncrequest will add 'r10bio-remaining' for both rdev and replacement rdev. However, if the read io fails, recoveryrequestwrite returns without issuing the write io, in...

How to check whether Citrix Licensing is in Grace Period using PowerShell?

This article describes how to use PowerShell cmdlets to check whether Citrix Licensing is in grace period and the number of hours remaining in the grace period...

kernel: regulator: core: Prevent integer underflow

In the Linux kernel, the following vulnerability has been resolved: regulator: core: Prevent integer underflow By using a ratio of delay to pollenabledtime that is not integer timeremaining underflows and does not exit the loop as expected. As delay could be derived from DT and pollenabledtime is...

kernel: md/raid10: fix leak of 'r10bio->remaining' for recovery

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix leak of 'r10bio-remaining' for recovery raid10syncrequest will add 'r10bio-remaining' for both rdev and replacement rdev. However, if the read io fails, recoveryrequestwrite returns without issuing the write io, in...

amount could still have some dust left

Lines of code Vulnerability details Impact Amount can still remain after transfer process that can lead unbalancing of length between sources, targets and amount that can lead to unexpected behavior. Proof of Concept There is no means to check inside delegateMulti function that either all amount ...

CLSA-2023-1696970233 libwebp: Fix of 3 CVEs

CVE-2018-25013, CVE-2018-25014: wait for all threads to be done in DecodeRemaining - CVE-2023-1999: fix a double free error...

MAL-2023-1033 Malicious code in eslint-plugin-scp-custom-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8860b8044f2adb9c969cdcf764976c8f9e110be9d0b0a03d095998595aec3938 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-35857

In Siren Investigate before 13.2.2, session keys remain active even after logging out...

Upgraded Q -> M from #272 [1668215320788]

Judge has assessed an item in Issue 272 as M risk. The relevant finding follows: Inaccurate comment can be misleading. The following retrievePledgeRewards function is for retrieving the non-distributed rewards from an expired pledge, not just a closed pledge. Calling this function for a pledge th...

Malicious code in vkwzriqpsabdfhnc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9e3fac1f09b90eac58f8fc7903fc35f2693ae0a707fbb9dcea1be7e564ee92a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-a11y-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cecbb13b2b8917576e26bbdec25a0abb4d327772f95afe872ac641949eeb4f50 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Envoy 资源管理错误漏洞

Envoy is an open source distributed proxy server.A security vulnerability exists in versions of Envoy prior to 1.22.1, which stems from the fact that OAuth filters will attempt to invoke the remaining filters in the chain after issuing a local response. No detailed vulnerability details are...

The Opportunities—and Obstacles—for Women at NSA and Cyber Command

WIRED spoke with three women working in cybersecurity in the US intelligence community about the progress of recent years and the work that remains...

CVE-2019-2089

In app uninstallation, there is a possible set of permissions that may not be removed from a shared app ID. This could lead to a local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10 Android...