SUSE CVE-2024-50024

In the Linux kernel, the following vulnerability has been resolved: net: Fix an unsafe loop on the list The kernel may crash when deleting a genetlink family if there are still listeners for that family: Oops: Kernel access of bad area, sig: 11 1 ... NIP c000000000c080bc...

SUSE CVE-2024-50058

In the Linux kernel, the following vulnerability has been resolved: serial: protect uartportdtrrts in uartshutdown too Commit af224ca2df29 serial: core: Prevent unsafe uart port access, part 3 added few uport == NULL checks. It added one to uartshutdown, so the commit assumes, uport can be NULL i...

CVE-2022-48974 netfilter: conntrack: fix using __this_cpu_add in preemptible

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: fix using thiscpuadd in preemptible Currently in nfconntrackhashcheckinsert, when it fails in nfctextvalidpre/post, NFCTSTATINC will be called in the preemptible context, a call trace can be triggered: BUG:...

AZL-51456 CVE-2024-49936 affecting package kernel for versions less than 5.15.173.1-1

In the Linux kernel, the following vulnerability has been resolved: net/xen-netback: prevent UAF in xenvifflushhash During the listforeachentryrcu iteration call of xenvifflushhash, kfreercu does not exist inside the rcu read critical section, so if kfreercu is called when the rcu grace period en...

DEBIAN-CVE-2024-49876

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix UAF around queue destruction We currently do stuff like queuing the final destruction step on a random system wq, which will outlive the driver instance. With bad timing we can teardown the driver with one or more wor...

UBUNTU-CVE-2024-49936

In the Linux kernel, the following vulnerability has been resolved: net/xen-netback: prevent UAF in xenvifflushhash During the listforeachentryrcu iteration call of xenvifflushhash, kfreercu does not exist inside the rcu read critical section, so if kfreercu is called when the rcu grace period en...

OESA-2024-2274 firefox security update

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions. Security Fixes: Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable...

Medium: openssl

Issue Overview: Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers from the client side to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause...

[SECURITY] Fedora 39 Update: rust-brotli-7.0.0-2.fc39

A brotli compressor and decompressor that with an interface avoiding the rust stdlib. This makes it suitable for embedded devices and kernels. It is designed with a pluggable allocator so that the standard lib's allocator may be employed. The default build also includes a stdlib allocator and...

The vulnerability of the secure kernel mode of Windows operating systems allows attackers to enhance their privileges.

The vulnerability of the Windows operating system’s safe mode relates to the swapping of a non-trusted pointer. Exploiting this vulnerability can allow an attacker to increase their privileges...

KB5046398: Windows Recovery Environment update for Windows 11, version 21H2: October 8, 2024

None None...

PT-2024-6887 · Adobe · Lightroom Desktop

Name of the Vulnerable Software and Affected Versions: Lightroom Desktop versions 7.4.1, 13.5, 12.5.1 and earlier Description: The issue is related to an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass...

Malicious code in kupo-capacitor-statusbar-safe-area (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4a521062da847cc39c10b9c614e06ebe609aa0aa6285be6e55fb1a5e2bf84ee7 The OpenSSF Package Analysis project identified 'kupo-capacitor-statusbar-safe-area' @ 9.0.0 npm as malicious. It is considered malicious becaus...

MAL-2024-9074 Malicious code in kupo-capacitor-statusbar-safe-area (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4a521062da847cc39c10b9c614e06ebe609aa0aa6285be6e55fb1a5e2bf84ee7 The OpenSSF Package Analysis project identified 'kupo-capacitor-statusbar-safe-area' @ 9.0.0 npm as malicious. It is considered malicious becaus...

ViciDial 2.0.5 Cross Site Request Forgery

============================================================================================================================================= | Title : ViciDial Call Center - astguiclient - thirtieth public release 2.0.5 CSRF Add ADmin Vulnerability | | Author : indoushka | | Tested on : windows ...

The vulnerability of the fromSafeClientFilter function in the microprogramming software for Tenda FH1201 allows a hacker to trigger a service failure.

The vulnerability of the fromSafeClientFilter function in the microprogramming software for Tenda FH1201 is related to buffer overflow based on a stack. Exploiting this vulnerability can allow an attacker to trigger a service failure through a specially crafted POST request...

SUSE-SU-2024:3500-1 Security update for openssl-3

This update for openssl-3 fixes the following issues: - CVE-2024-41996: Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers to trigger expensive server-side DHE bsc1230698...

A week in security (September 23 – September 29)

Last week on Malwarebytes Labs: Millions of Kia vehicles were vulnerable to remote attacks with just a license plate number Privacy watchdog files complaint over Firefox quietly enabling its Privacy Preserving Attribution Telegram will hand over user details to law enforcement Don’t share the vir...

DEBIAN-CVE-2024-46834

In the Linux kernel, the following vulnerability has been resolved: ethtool: fail closed if we can't get max channel used in indirection tables Commit 0d1b7d6c9274 "bnxt: fix crashes when reducing ring count with active RSS contexts" proves that allowing indirection table to contain channels with...

Google's Shift to Rust Programming Cuts Android Memory Vulnerabilities by 68%

Google has revealed that its transition to memory-safe languages such as Rust as part of its secure-by-design approach has led to the percentage of memory-safe vulnerabilities discovered in Android dropping from 76% to 24% over a period of six years. The tech giant said focusing on Safe Coding fo...