CVE-2022-48771

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix stale file descriptors on failed usercopy A failing usercopy of the fencerep object will lead to a stale entry in the file descriptor table as putunusedfd won't release it. This enables userland to refer to a...

CVE-2022-48743

In the Linux kernel, the following vulnerability has been resolved: net: amd-xgbe: Fix skb data length underflow There will be BUGON triggered in include/linux/skbuff.h leading to intermittent kernel panic, when the skb length underflow is detected. Fix this by dropping the packet if such length...

CVE-2022-48718

In the Linux kernel, the following vulnerability has been resolved: drm: mxsfb: Fix NULL pointer dereference mxsfb should not ever dereference the NULL pointer which drmatomicgetnewbridgestate is allowed to return. Assume a fixed format instead...

CVE-2024-5564 affecting package libndp for versions less than 1.8-2

CVE-2024-5564 affecting package libndp for versions less than 1.8-2. A patched version of the package is available...

DEBIAN-CVE-2021-47591

In the Linux kernel, the following vulnerability has been resolved: mptcp: remove tcp ulp setsockopt support TCPULP setsockopt cannot be used for mptcp because its already used internally to plumb subflow tcp sockets to the mptcp layer. syzbot managed to trigger a crash for mptcp connections that...

TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option

Impact A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content extraction code. When using the noneditableregexp option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor. Patches This vulnerability...

SUSE-SU-2024:2090-1 Security update for podman

This update for podman fixes the following issues: - Update to version 4.9.5 - CVE-2024-3727: Fixed a flaw that allowed attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks. bsc1224122 -...

PT-2024-27120 · Weblir · Weblir Login As Customer Pro

Name of the Vulnerable Software and Affected Versions: Weblir Login as customer PRO module versions prior to 1.2.7 Description: The issue allows a guest to access a direct link to connect to each customer account of the shop if the module is not installed or if a secret accessible to the...

Oracle Linux 7 : flatpak (ELSA-2024-3980)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-3980 advisory. 1.0.9-13 - Fix CVE-2024-32462 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not...

Security update for gdcm (important)

openSUSE Security Update: Security update for gdcm Announcement ID: openSUSE-SU-2024:0167-1 Rating: important References: 1223398 Cross-References: CVE-2024-22373 CVSS scores: CVE-2024-22373 SUSE: 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP5 An...

DeepJavaLibrary API absolute path traversal

Summary DeepJavaLibraryDJL versions 0.1.0 through 0.27.0 do not prevent absolute path archived artifacts from inserting archived files directly into the system, overwriting system files. This is fixed in DJL 0.28.0 and patched in DJL Large Model Inference containers 0.27.0. Impacted versions: 0.1...

ws affected by a DoS when handling a request with many HTTP headers

Impact A request with a number of headers exceeding the server.maxHeadersCount threshold could be used to crash a ws server. Proof of concept js const http = require'http'; const WebSocket = require'ws'; const wss = new WebSocket.Server port: 0 , function const chars =...

OPENSUSE-SU-2024:12060-1 patch-2.7.6-5.1 on GA media

These are all security issues fixed in the patch-2.7.6-5.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11431-1 libkpathsea6-6.3.3-76.3 on GA media

These are all security issues fixed in the libkpathsea6-6.3.3-76.3 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11647-1 docker-20.10.11_ce-1.1 on GA media

These are all security issues fixed in the docker-20.10.11ce-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:12972-1 libopenssl-1_1-devel-1.1.1u-1.1 on GA media

These are all security issues fixed in the libopenssl-11-devel-1.1.1u-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:12332-1 ffmpeg-5-5.1.1-1.1 on GA media

These are all security issues fixed in the ffmpeg-5-5.1.1-1.1 package on the GA media of openSUSE Tumbleweed...

Read-only users can restore old versions

None...

CVE-2024-36106

A flaw was found in Argo-CD. Error messages in Argo-CD may contain sensitive information, such as clusters and project names, which allows authenticated malicious users to enumerate possible targets...

Android Security Bulletin—June 2024Stay organized with collectionsSave and categorize content based on your preferences.

The Android Automotive OS AAOS Update Bulletin contains details of security vulnerabilities affecting the Android Automotive OS platform. The full AAOS update comprises the security patch level of 2024-06-05 or later from the June 2024 Android Security Bulletin in addition to all issues in this...