ALSA-2024:2180 Moderate: runc security update

The runC tool is a lightweight, portable implementation of the Open Container Format OCF that provides container runtime. Security Fixes: golang: io/fs: stack exhaustion in Glob CVE-2022-30630 golang: compress/gzip: stack exhaustion in Reader.Read CVE-2022-30631 golang: path/filepath: stack...

Moderate: runc security update

The runC tool is a lightweight, portable implementation of the Open Container Format OCF that provides container runtime. Security Fixes: golang: io/fs: stack exhaustion in Glob CVE-2022-30630 golang: compress/gzip: stack exhaustion in Reader.Read CVE-2022-30631 golang: path/filepath: stack...

CVE-2024-3154

creationtimestamp| type| source ---|---|--- 2024-04-29 16:19:03+00:00| published-proof-of-concept| https://github.com/cri-o/cri-o/security/advisories/GHSA-2cgq-h8xw-2v5j...

Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2024-597)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-597 advisory. .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability CVE-2024-21409 Tenable has extracted the preceding description block directly from the tested product security advisory. Note...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2024-604)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-604 advisory. A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over...

[SECURITY] Fedora 40 Update: golang-gvisor-20240408.0-1.20240418git9e5a99b.fc40

gVisor is an open-source, OCI-compatible sandbox runtime that provides a virtualized container environment. It runs containers with a new user-space kernel, delivering a low overhead container security solution for high-density applications. gVisor integrates with Docker, containerd and Kubernete...

Security Bulletin: IBM MQ is affected by a vulnerability in the IBM Semeru Runtime (CVE-2024-20952)

Summary An issue was identified with IBM Semeru Runtime, Version 17, which is used in IBM MQ Explorer. Vulnerability Details CVEID:CVE-2024-20952 DESCRIPTION: An unspecified vulnerability in Java SE related to the Security component could allow a remote attacker to cause high confidentiality impa...

PT-2024-25176 · Quickjs +2 · Quickjs +2

Name of the Vulnerable Software and Affected Versions: QuickJS version 3b45d15 Description: The issue is related to an Assertion Failure via JS FreeRuntimeJSRuntime at quickjs.c. Recommendations: For QuickJS version 3b45d15, consider avoiding the use of JS FreeRuntimeJSRuntime until a patch is...

PT-2024-9916 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the pm runtime get sync function in the mtk-cmdq component of the Linux kernel. The problem arises from the lack of return value checking of this function. When...

Security Bulletin: IBM Administration Runtime Expert for i is vulnerable to attacker executing arbitrary code on the system due to Dojo (CVE-2021-23450)

Summary IBM Administration Runtime Expert for i uses Dojo to render it's web interface. Dojo 1.3.3 could allow an attacker to execute arbitrary code on the system, as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerability as describ...

CVE-2024-32869 Hono vulnerable to Restricted Directory Traversal in serveStatic with deno

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.2.7, when using serveStatic with deno, it is possible to traverse the directory where main.ts is located. This can result in retrieval of unexpected files. Version 4.2.7 contains a patch for t...

GHSA-3MPF-RCC7-5347 Hono vulnerable to Restricted Directory Traversal in serveStatic with deno

Summary When using serveStatic with deno, it is possible to directory traverse where main.ts is located. My environment is configured as per this tutorial https://hono.dev/getting-started/deno PoC bash $ tree . ├── deno.json ├── deno.lock ├── main.ts ├── README.md └── static └── a.txt source jsx...

PT-2024-25770 · Bytecode Alliance +2 · Wasm-Micro-Runtime +2

Name of the Vulnerable Software and Affected Versions: Bytecode Alliance wasm-micro-runtime version 2.0.0 Description: An out-of-bound memory read issue was discovered, allowing a remote attacker to cause a denial of service via the block type get arity function in core/iwasm/interpreter/wasm.h...

PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

...

Tcl 安全漏洞

Tcl is a freely available open source package. It provides a powerful platform for creating integrated applications that tie together various applications, protocols, devices and frameworks. A security vulnerability exists in TCL 30Z , TCL 10 that stems from the fact that certain software version...

CRI-O 命令注入漏洞

CRI-O is a lightweight container runtime environment for Kubernetes systems. CRI-O suffers from a security vulnerability that stems from the ability to inject arbitrary systemd attributes via Pod annotations, which allows any user who can create a Pod using the annotations to perform arbitrary...

[SECURITY] Fedora 40 Update: nodejs18-18.20.2-1.fc40

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed...

[SECURITY] Fedora 40 Update: dotnet8.0-8.0.103-1.fc40

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

OESA-2024-1474 cri-o security update

Open Container Initiative-based implementation of Kubernetes Container Runtime Interface. Security Fixes: Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amount...

OESA-2024-1472 cri-o security update

Open Container Initiative-based implementation of Kubernetes Container Runtime Interface. Security Fixes: Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amount...