MGASA-2024-0061 Updated java 1.8.0, 11 & latest packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Array out-of-bounds access due to missing range check in C1 compiler. CVE-2024-20918 RSA padding issue and timing side-channel attack against TLS. CVE-2024-20952 Arbitrary Java code execution in Nashorn. CVE-2024-20926 JVM class file verifier fla...

Updated mplayer packages fix security vulnerabilities

The MPlayer Project mencoder SVN-r38374-13.0.1 is vulnerable to Divide By Zero via the function config of llibmpcodecs/vfscale.c. CVE-2022-38850 Certain The MPlayer Project products are vulnerable to Out-of-bounds Read via function readmetarecord of mplayer/libmpdemux/asfheader.c. This affects...

Mageia: Security Advisory (MGASA-2024-0061)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2024-0060 Updated fonttools packages fix security vulnerabilities

As of fonttools=4.28.2 the subsetting module has a XML External Entity Injection XXE vulnerability which allows an attacker to resolve arbitrary entities when a candidate font OT-SVG fonts, which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem...

Updated open-vm-tools packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Authentication bypass vulnerability in the vgauth module. CVE-2023-20867 SAML token signature bypass. CVE-2023-34058 File descriptor hijack vulnerability in the vmware-user-suid-wrapper. CVE-2023-34059...

CISA Releases Fifteen Industrial Control Systems Advisories

CISA released fifteen Industrial Control Systems ICS advisories on March 14, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-074-01 Siemens SENTRON 7KM PAC3x20 ICSA-24-074-02 Siemens Solid Edge ICSA-24-074-03...

Arm DS for Intel® SoC FPGA Software Advisory

This advisory contains CVEs in Altera products and has been transferred to Altera for support. The updated advisory can be found at the link below: https://www.altera.com/product-security/advisory-archive/intel-sa-00930.html...

MGASA-2024-0056 Updated java-17-openjdk packages fix security vulnerabilities

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fixes: OpenJDK: memory corruption issue on x8664 with AVX-512 8317121 CVE-2023-22025 OpenJDK: certificate path validation issue during client authentication...

The vulnerability of platform monitoring systems for events detection, threat detection, and security analytics in IBM QRadar Suite and IBM Cloud Pak for Security lies in the ability to access channels from non-endpoints, allowing attackers to carry out “man-in-the-middle” attacks.

The vulnerabilities of event monitoring platforms, threat detection systems, and security analytics tools from IBM QRadar Suite and IBM Cloud Pak for Security are related to access from a point that is not a final destination. Exploiting these vulnerabilities could allow a remote attacker to carr...

CVE-2023-48788

creationtimestamp| type| source ---|---|--- 2024-03-12 16:26:39+00:00| seen| https://t.me/ctinow/205806 2024-03-12 16:32:08+00:00| seen| https://t.me/ctinow/205822 2024-03-13 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1246 2024-03-13 15:30:05+00:00| seen|...

March 12, 2024—KB5035845 (OS Builds 19044.4170 and 19045.4170) - EXPIRED

None None...

March 12, 2024—KB5035854 (OS Build 22000.2836)

None None...

March 12, 2024—KB5035858 (OS Build 10240.20526) - EXPIRED

None None...

EulerOS 2.0 SP11 : kernel (EulerOS-SA-2024-1215)

"According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In the Linux kernel before 6.4.5, drivers/gpu/drm/drmatomic.c has a use-after-free during a race condition between a nonblocking atomic commit an...

EulerOS 2.0 SP8 : python2 (EulerOS-SA-2024-1290)

According to the versions of the python2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A use-after-free exists in Python through 3.9 via heappushpop in heapq. CVE-2022-48560 - An XML External Entity XXE issue was discovered in...

Intel® 4th Gen Intel® Xeon® Processor Advisory

Summary: Potential security vulnerabilities in some 4th Generation Intel® Xeon® Processors when using Intel® Software Guard Extensions SGX or Intel® Trust Domain Extensions TDX may allow escalation of privilege or information disclosure. Intel is releasing firmware updates to mitigate these...

2024.1 IPU - Intel® Chipset Software and SPS Advisory

Summary: Potential security vulnerabilities in the Intel® Converged Security Management Engine CSME installer, Intel® Local Manageability Service software and Intel® Server Platform Servcies SPS may allow information disclosure, escalation of privilege, or denial of service. Vulnerability Details...

Security Bulletin: Multiple security vulnerabilities has been identified in IBM WebSphere Application Server shipped with Tivoli Netcool/OMNIbus WebGUI due to January 2024 CPU

Summary Websphere Application Server WAS is shipped as a component of Tivoli Netcool/OMNIbus WebGUI. Information about security vulnerabilities affecting WAS has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity

Cyberspace Mapping Dork Fofa app="JETBRAINS-TeamCity...

Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition for IBM Content Collector for SAP Applications

Summary Multiple Vulnerabilities were disclosed as part of the Oracle Jan 2024 Critical Patch Update. Vulnerability Details CVEID:CVE-2024-20918 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause high confidentiality impact and...