CVE-2024-42290 irqchip/imx-irqsteer: Handle runtime power management correctly

In the Linux kernel, the following vulnerability has been resolved: irqchip/imx-irqsteer: Handle runtime power management correctly The power domain is automatically activated from clkprepare. However, on certain platforms like i.MX8QM and i.MX8QXP, the power-on handling invokes sleeping function...

kernel: net/sched: Fix mirred deadlock on device recursion

In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix mirred deadlock on device recursion The Linux kernel CVE team has assigned CVE-2024-27010 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050148-CVE-2024-27010-5a68@gregkh/T...

kernel: net/sched: act_skbmod: prevent kernel-infoleak

In the Linux kernel, the following vulnerability has been resolved: net/sched: actskbmod: prevent kernel-infoleak syzbot found that tcfskbmoddump was copying four bytes from kernel stack to user space 1. The issue here is that 'struct tcskbmod' has a four bytes hole. We need to clear the structur...

SUSE CVE-2024-42245

In the Linux kernel, the following vulnerability has been resolved: Revert "sched/fair: Make sure to try to detach at least one movable task" This reverts commit b0defa7ae03ecf91b8bfd10ede430cff12fcbd06. b0defa7ae03ec changed the load balancing logic to ignore env.maxloop if all tasks examined to...

UBUNTU-CVE-2024-42245

In the Linux kernel, the following vulnerability has been resolved: Revert "sched/fair: Make sure to try to detach at least one movable task" This reverts commit b0defa7ae03ecf91b8bfd10ede430cff12fcbd06. b0defa7ae03ec changed the load balancing logic to ignore env.maxloop if all tasks examined to...

The vulnerability of the taprio_parse_mqprio_opt() function in the network/scheduler subsystem of the Linux operating system allows a attacker to compromise the integrity and accessibility of protected information.

The vulnerability of the taprioparsemqprioopt function in the net/sched/schtaprio.c module, part of the network scheduling subsystem in the Linux operating system’s kernel, is related to insufficient validation of data received from users. Exploiting this vulnerability could allow an attacker to...

New Windows Backdoor BITSLOTH Exploits BITS for Stealthy Communication

Cybersecurity researchers have discovered a previously undocumented Windows backdoor that leverages a built-in feature called Background Intelligent Transfer Service BITS as a command-and-control C2 mechanism. The newly identified malware strain has been codenamed BITSLOTH by Elastic Security Lab...

DEBIAN-CVE-2024-42114

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: restrict NL80211ATTRTXQQUANTUM values syzbot is able to trigger softlockups, setting NL80211ATTRTXQQUANTUM to 2^31. We had a similar issue in schfq, fixed with commit d9e15a273306 "pktsched: fq: do not accept sill...

[SECURITY] Fedora 40 Update: kubernetes-1.29.7-1.fc40

Open Source Production-Grade Container Scheduling And Management Platform Installs kubelet, the kubernetes agent on each machine in a cluster. The kubernetes-client sub-package, containing kubectl, is recommended but not strictly required. The kubernetes-client sub-package should be installed on...

kernel: net/sched: act_mirred: don't override retval if we already lost the skb

A use-after-free flaw was found in net/sched/actmirred.c in the Linux kernel. This may result in a crash...

CLSA-2024-1721659604 Fix of 96 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-35902 - net/rds: fix possible cp null dereference CVE-url: https://ubuntu.com/security/CVE-2024-38587 - speakup: Fix sizeof vs ARRAYSIZE bug CVE-url: https://ubuntu.com/security/CVE-2024-39493 - crypto: qat - Fix ADFDEVRESETSYNC memory leak CVE-url:...

CVE-2024-37262

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in vCita.Com Online Booking & Scheduling Calendar for WordPress by vcita allows Reflected XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through...

CVE-2024-37262 WordPress Online Booking & Scheduling Calendar plugin <= 4.4.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in vCita.Com Online Booking & Scheduling Calendar for WordPress by vcita allows Reflected XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through...

CVE-2024-37460

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in SuperSaaS SuperSaaS – online appointment scheduling allows Stored XSS.This issue affects SuperSaaS – online appointment scheduling: from n/a through 2.1.9...

CVE-2024-37460 WordPress SuperSaaS – online appointment scheduling plugin <= 2.1.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in SuperSaaS SuperSaaS – online appointment scheduling allows Stored XSS.This issue affects SuperSaaS – online appointment scheduling: from n/a through 2.1.9...

The vulnerability of the Import Utility component of the Oracle Production Scheduling application, a part of the Oracle E-Business Suite automation system for business operations, allows an attacker to gain access to modify, add, or delete data.

The vulnerability of the Import Utility component in the Oracle Production Scheduling application exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to gain access to the system, enabling them to modify, add, or delete data remotely...

The vulnerability of the Request Submission and Scheduling components of the Oracle Concurrent Processing application in the Oracle E-Business Suite allows attackers to disclose sensitive information.

The vulnerability of the Request Submission and Scheduling components in Oracle Concurrent Processing of the Oracle E-Business Suite exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose sensitive...

CVE-2022-48845

In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: fill in sibling and core maps earlier After enabling CONFIGSCHEDCORE landed during 5.14 cycle, 2-core 2-thread-per-core interAptiv CPS-driven started emitting the following: 0.025698 CPU1 revision is: 0001a120 MIPS...

CVE-2022-48845 MIPS: smp: fill in sibling and core maps earlier

In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: fill in sibling and core maps earlier After enabling CONFIGSCHEDCORE landed during 5.14 cycle, 2-core 2-thread-per-core interAptiv CPS-driven started emitting the following: 0.025698 CPU1 revision is: 0001a120 MIPS...

CVE-2022-48845

CVE-2022-48845 affects the Linux kernel on MIPS SMP builds, where mis-timing of CPU topology map calculation caused smt_mask (cpu_smt_mask) to be empty during sched_core_cpu_starting(). The issue arises after enabling CONFIG_SCHED_CORE (landed around 5.14), leading to a WARN at sched_core_cpu_sta...