GHSA-8XF4-W7QW-PJJW Firebase PHP-JWT key/algorithm type confusion

In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue e.g., RS256 / HS256 exists via the kid aka Key ID header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a straightforward way t...

Design/Logic Flaw

In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue e.g., RS256 / HS256 exists via the kid aka Key ID header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a straightforward way t...

Just-Released Dark Souls Game, Elden Ring, Includes Killer Bug

The latest installment of the Dark Souls gaming franchise, Elden Ring, contains a security vulnerability that allows bad actors to throw players on PCs into an endless loop of losing their characters’ lives, rendering it essentially unplayable. Malwarebytes Labs researcher Christopher Boyd said...

Elden Ring exploit traps players in infinite death loop

Back in January, we wrote about how the Dark Souls games had their online components switched off for PC gamers. This is because someone figured out how to execute code remotely on the target’s PC. Given that the multiplayer angle of Souls games is rather important, this was quite a body blow for...

GSD-2022-1000871 xen/xenbus: don't let xenbus_grant_ring() remove grants in error case

xen/xenbus: don't let xenbusgrantring remove grants in error case This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.184 by commit...

PT-2022-29032

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.28 Description The issue is related to the xen/xenbus component, specifically the xenbus grant ring function, which may remove grants in error cases. The actual impact and attack plausibility have not yet...

PT-2022-29098

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.10.105 Description The issue is related to the xen/xenbus component, specifically the xenbus grant ring function, which may remove grants in error cases. The actual impact and attack plausibility have not yet...

PT-2022-29192

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.271 Description The issue is related to the xenbus grant ring function, which may remove grants in error cases. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

PT-2022-29212

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.306 Description The issue is related to the xenbus grant ring function in the xen/xenbus component. It may allow the removal of grants in error cases. The actual impact and attack plausibility have not yet...

PT-2022-28961

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.16.14 Description The issue is related to the xen/xenbus component, specifically the xenbus grant ring function, which may remove grants in error cases. The actual impact and attack plausibility have not yet be...

PT-2022-29145

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.184 Description The issue is related to the xen/xenbus component, specifically the xenbus grant ring function, which may remove grants in error cases. The actual impact and attack plausibility have not yet...

PT-2022-29170

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 4.19.234 Description The issue is related to the xenbus grant ring function, which may remove grants in error cases. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVM_XEN_HVM_SET_ATTR ioctl. This flaw affects Linux kernel versions prior to 5.17-rc1.

...

PT-2022-7507

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a NULL pointer dereference in the ice update vsi tx ring stats function, which updates Tx ring stats. This can lead to a denial of service. The problem occurs...

CVE-2021-4095

A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVMXENHVMSETATTR ioctl. This fl...

CVE-2021-4095

A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVMXENHVMSETATTR ioctl. This fl...

DEBIAN-CVE-2021-4095

A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVMXENHVMSETATTR ioctl. This fl...

Null pointer dereference

A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVMXENHVMSETATTR ioctl. This fl...

UBUNTU-CVE-2021-4095

A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVMXENHVMSETATTR ioctl. This fl...

CVE-2021-4095

A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVMXENHVMSETATTR ioctl. This fl...