October 22, 2024-KB5045991 Cumulative Update Preview for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 Version 22H2

None None...

CVE-2024-49987

In the Linux kernel, the following vulnerability has been resolved: bpftool: Fix undefined behavior in qsortNULL, 0, ... When netfilter has no entry to display, qsort is called with qsortNULL, 0, .... This results in undefined behavior, as UBSan reports: net.c:827:2: runtime error: null pointer...

Fedora 40 : oath-toolkit (2024-cb2e1f0168)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-cb2e1f0168 advisory. This is new version fixing possible local privilege escalation. Tenable has extracted the preceding description block directly from the Fedora...

Fedora 40 : libarchive (2024-80e4603b92)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-80e4603b92 advisory. Fix for CVE-2024-48957 ---- Automatic update for libarchive-3.7.2-6.fc40. Tenable has extracted the preceding description block directly from the Fedora...

Fedora 39 : unbound (2024-2ba00c906c)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-2ba00c906c advisory. Fixed builds on F41. Fixes CVE-2024-8508 - https://github.com/NLnetLabs/unbound/releases/tag/release-1.21.1 Tenable has extracted the preceding...

Vulnerabilities fixed in Oracle Analytics

Oracle has fixed vulnerabilities in Analytics products. A malicious party can exploit the vulnerabilities to launch attacks that can lead to the following categories of damage: - Denial-of-Service - Manipulation of data - Execution of arbitrary code User Rights - Execution of arbitrary code...

Vulnerabilities fixed in Oracle Peoplesoft

Oracle has fixed vulnerabilities in Peoplesoft. A malicious party could exploit the vulnerabilities to cause a Denial-of-Service DoS, or to access and potentially manipulate personal sensitive data in the database. Oracle has released updates to fix the vulnerabilities. See attached references fo...

Oracle Releases Quarterly Critical Patch Update Advisory for October 2024

Oracle released its quarterly Critical Patch Update Advisory for October 2024 to address vulnerabilities in multiple products. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following...

SAS CTF and the many ways to persist a kernel shellcode on Windows 7

On May 18, 2024, Kaspersky's Global Research & Analysis Team GReAT, with the help of its partners, held the qualifying stage of the SAS CTF, an international competition of cybersecurity experts held as part of the Security Analyst Summit conference. More than 800 teams from all over the world to...

GitHub Patches Critical Flaw in Enterprise Server Allowing Unauthorized Instance Access

GitHub has released security updates for Enterprise Server GHES to address multiple issues, including a critical bug that could allow unauthorized access to an instance. The vulnerability, tracked as CVE-2024-9487, carries a CVS score of 9.5 out of a maximum of 10.0 "An attacker could bypass SAML...

CVE-2024-21209

Vulnerability in the MySQL Client product of Oracle MySQL component: Client: mysqldump. Supported versions that are affected are 8.4.2 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL...

CVE-2024-21238

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Thread Pooling. Supported versions that are affected are 8.0.39 and prior, 8.4.1 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols...

Vulnerabilities fixed in Splunk Enterprise

Splunk has fixed vulnerabilities in Splunk Enterprise. A malicious party could exploit the vulnerabilities to gain access to sensitive data, or execute arbitrary code in the context of the application. For successful abuse, the malicious party must be authenticated prior. Splunk has released...

Security Updates for Azure CLI (October 2024)

The Azure CLI is missing security updates. It is, therefore, affected by an elevation of privilege vulnerability. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'...

OPENSUSE-SU-2024:14402-1 haproxy-3.0.5+git0.8e879a52e-2.1 on GA media

These are all security issues fixed in the haproxy-3.0.5+git0.8e879a52e-2.1 package on the GA media of openSUSE Tumbleweed...

Oracle Linux 7 : bind (ELSA-2024-5930)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-5930 advisory. - Resolve CVE-2024-1975 - Resolve CVE-2024-1737 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-724)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-724 advisory. In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix AUX buffer serialization CVE-2024-46713 In the Linux kernel, the following vulnerability has been resolved:...

Microsoft Security Update Validation Report October 2024

Microsoft’s October 2024 security updates have passed Citrix testing the updates are listed below. The testing is not all-inclusive; all tests are executed against English only environments and issues may still be found upon implementation. Follow best practices for testing and installing softwar...

Security Updates for Microsoft Visual Studio Products (October 2024)

The Microsoft Visual Studio Products are missing security updates. They are, therefore, affected by multiple vulnerabilities, including: - .NET Denial of Service Vulnerability in System.Security.Cryptography.Cose, System.IO.Packaging, System.Runtime.Caching CVE-2024-43483 - .NET Denial of Service...

Security Updates for Microsoft Office Products C2R (October 2024)

The Microsoft Office Products are missing a security update. It is, therefore, affected by the following vulnerabilities: - Microsoft Office is affected by a remote code execution vulnerability. CVE-2024-43576 - Microsoft Office is affected by a remote code execution vulnerability. CVE-2024-43616...