3092 matches found
Microsoft Windows Autopatch is Now Generally Available for Enterprise Systems
Microsoft on Monday announced the general availability of a feature called Autopatch that automatically keeps Windows and Office software up-to-date on enrolled endpoints. The launch, which comes a day before Microsoft is expected to release its monthly round of security patches, is available for...
Samsung Find My Mobile 安全特征问题漏洞
Samsung Find My Mobile is a free service from Samsung in South Korea that makes it easy to locate, ring or erase your device from the network. A security feature issue vulnerability exists in versions prior to Samsung Find My Mobile 7.2.24.12, which can easily locate, ring or erase your device fr...
OESA-2022-1714 kernel security update
The Linux Kernel, the operating system core itself. Security Fixes: An out-of-bound write vulnerability was identified within the netfilter subsystem which can be exploited to achieve privilege escalation to root.CVE-2022-1972 A use-after-free flaw was found in the Linux kernel's NFC core...
PT-2022-1375 · Linux +9 · Linux Kernel +9
Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe resize ring. The specific flaw exists within the handling of pipe buffers. The issue results...
kernel: igc: avoid kernel warning when changing RX ring parameters
In the Linux kernel, the following vulnerability has been resolved: igc: avoid kernel warning when changing RX ring parameters Calling ethtool changing the RX ring parameters like this: $ ethtool -G eth0 rx 1024 on igc triggers kernel warnings like this: 225.198467 ------------ cut here...
GSD-2022-1001547 igc: avoid kernel warning when changing RX ring parameters
igc: avoid kernel warning when changing RX ring parameters This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.19 by commit...
GSD-2022-1001234 igc: avoid kernel warning when changing RX ring parameters
igc: avoid kernel warning when changing RX ring parameters This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...
UBUNTU-CVE-2022-1263
A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service...
CVE-2022-1263
A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service...
CVE-2022-1263
A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service...
PT-2022-4326 · Linux +7 · Linux Kernel +7
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to the fixed version Description: The issue is related to a NULL pointer dereference in the KVM subsystem of the Linux kernel, specifically in the kvm dirty ring push function. This flaw can be exploited by an...
Validation Bypass
firebase/php-jwt is vulnerable to validation bypass. The vulnerability exists in decode and verify functions in JWT.php because the token validations are not properly handled when multiple keys are loaded in a key ring which allows an attacker to bypass server-side validations...
GHSA-8XF4-W7QW-PJJW Firebase PHP-JWT key/algorithm type confusion
In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue e.g., RS256 / HS256 exists via the kid aka Key ID header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a straightforward way t...
Firebase PHP-JWT key/algorithm type confusion
In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue e.g., RS256 / HS256 exists via the kid aka Key ID header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a straightforward way t...
Design/Logic Flaw
In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue e.g., RS256 / HS256 exists via the kid aka Key ID header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a straightforward way t...
Just-Released Dark Souls Game, Elden Ring, Includes Killer Bug
The latest installment of the Dark Souls gaming franchise, Elden Ring, contains a security vulnerability that allows bad actors to throw players on PCs into an endless loop of losing their characters’ lives, rendering it essentially unplayable. Malwarebytes Labs researcher Christopher Boyd said...
Elden Ring exploit traps players in infinite death loop
Back in January, we wrote about how the Dark Souls games had their online components switched off for PC gamers. This is because someone figured out how to execute code remotely on the target’s PC. Given that the multiplayer angle of Souls games is rather important, this was quite a body blow for...
GSD-2022-1000871 xen/xenbus: don't let xenbus_grant_ring() remove grants in error case
xen/xenbus: don't let xenbusgrantring remove grants in error case This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.184 by commit...
A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVM_XEN_HVM_SET_ATTR ioctl. This flaw affects Linux kernel versions prior to 5.17-rc1.
...
CVE-2021-4095
A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVMXENHVMSETATTR ioctl. This fl...