SUSE-SU-2024:1695-1 Security update for the Linux Kernel RT (Live Patch 5 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505001318 fixes several issues. The following security issues were fixed: - CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in perfreadgroup bsc1216644. - CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi bsc1221302. - CVE-2022-48651:...

SUSE-SU-2024:1694-1 Security update for the Linux Kernel (Live Patch 54 for SLE 12 SP5)

This update for the Linux Kernel 4.12.14-122201 fixes several issues. The following security issues were fixed: - CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb-macheader bsc1223514. - CVE-2023-6546: Fixed a race condition that could lead to a use-after-free in the GSM 07...

CVE-2024-35939

In the Linux kernel, the following vulnerability has been resolved: dma-direct: Leak pages on dmasetdecrypted failure On TDX it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resulting memory is shared. Callers...

CVE-2024-35939

In the Linux kernel, the following vulnerability has been resolved: dma-direct: Leak pages on dmasetdecrypted failure On TDX it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resulting memory is shared. Callers...

CVE-2024-35939 dma-direct: Leak pages on dma_set_decrypted() failure

In the Linux kernel, the following vulnerability has been resolved: dma-direct: Leak pages on dmasetdecrypted failure On TDX it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resulting memory is shared. Callers...

CVE-2024-35939

CVE-2024-35939 : The Linux kernel vulnerability in the dma-direct path leaks pages on dma_set_decrypted() failure, allowing a local attacker to cause a denial of service by leaking memory rather than freeing it. Affected component: dma-direct in the Linux kernel (TDX context noted). Conditions: a...

SUSE-SU-2024:1679-1 Security update for the Linux Kernel RT (Live Patch 8 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505001327 fixes several issues. The following security issues were fixed: - CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi bsc1221302. - CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb-macheader bsc1223514. - CVE-2024-2676...

RHEL 9 : firefox (RHSA-2024:2884)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:2884 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

Grafana folders admin only permission privilege escalation

Today we are releasing Grafana 9.1.6, 9.0.9, 8.5.13. This patch release includes a Moderate severity security fix for CVE-2022-36062 that affects Grafana instances which are using Grafana role-based access control RBAC. Release 9.1.6, latest patch, also containing security fix: - Download Grafana...

Grafana User enumeration via forget password

Today we are releasing Grafana 9.2.4. Alongside other bug fixes, this patch release includes moderate security fixes for CVE-2022-39307. We are also releasing security patches for Grafana 8.5.15 to fix these issues. Release 9.2.4, latest patch, also containing security fix: - Download Grafana 9.2...

Grafana Fine-grained access control vulnerability

Impact On Nov. 2, during an internal security audit, we discovered that when the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance, Grafana 8.0 introduced a mechanism which allowed users with the Organization Admin role to list, ad...

Intel® Media SDK and Intel® oneVPL Software Advisory

Summary: Potential security vulnerabilities in Intel® Media SDK software and some Intel® oneAPI Video Processing Library oneVPL software may allow escalation of privilege, denial of service, and/or information disclosure. Intel is releasing software updates to mitigate these potential...

Arti -- Security issues related to circuit construction

Tor Project reports: When building anonymizing circuits to or from an onion service with 'lite' vanguards the default enabled, the circuit manager code would build the circuits with one hop too few. When 'full' vanguards are enabled, some circuits are supposed to be built with an extra hop to...

CVE-2024-34707

CVE-2024-34707 affects Nautobot where an admin user can modify BANNER_TOP, BANNER_BOTTOM, and BANNER_LOGIN via the /admin/constance/config/ endpoint, enabling insertion of arbitrary HTML and potentially stored XSS across Nautobot pages. Multiple connected sources confirm this risk and describe th...

SUSE-SU-2024:1626-1 Security update for python-pyOpenSSL

This update for python-pyOpenSSL fixes the following issues: - CVE-2018-1000807: Fixed a use-after-free in X509 object handling bsc1111635 - CVE-2018-1000808: Fixed a use-after-free in PKCS 12 Store bsc1111634...

RHEL 7 : virtuoso-opensource (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - virtuoso-opensource: Crash in boxdeserializereusing function CVE-2023-48952 - An issue in the libcmalloc...

RHEL 6 : mutt (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - mutt: buffer overflow via base64 data CVE-2018-14359 - An issue was discovered in Mutt before 1.10.1 and...

RHEL 5 : ncurses (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - ncurses: Stack-based buffer overflow caused by format string vulnerability in fmtentry function...

SUSE-SU-2024:1581-1 Security update for the Linux Kernel (Live Patch 39 for SLE 15 SP2)

This update for the Linux Kernel 5.3.18-15020024160 fixes several issues. The following security issues were fixed: - CVE-2024-0775: Fixed a use-after-free flaw was found in the ext4remount in fs/ext4/super.c in ext4 bsc1219079. - CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability perf...

SUSE-SU-2024:1580-1 Security update for the Linux Kernel (Live Patch 39 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-15030059144 fixes several issues. The following security issues were fixed: - CVE-2024-0775: Fixed a use-after-free flaw was found in the ext4remount in fs/ext4/super.c in ext4 bsc1219079. - CVE-2024-26622: Fixed a use-after-free bug in tomoyowritecontrol...