AZL-68297 CVE-2024-46754 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Remove tstrun from lwtseg6localprogops. The syzbot reported that the lwtseg6 related BPF ops can be invoked via bpftestrun without without entering inputactionendbpf first. Martin KaFai Lau said that self test for...

CVE-2024-46754

CVE-2024-46754 pertains to the Linux kernel BPF subsystem. The issue arises in the lwt_seg6local_prog_ops related to BPF_PROG_TYPE_LWT_SEG6LOCAL, where BPF test execution via bpf_test_run could occur without entering input_action_end_bpf() first. The root cause is tied to the seg6 local test path...

CVE-2024-46754 bpf: Remove tst_run from lwt_seg6local_prog_ops.

In the Linux kernel, the following vulnerability has been resolved: bpf: Remove tstrun from lwtseg6localprogops. The syzbot reported that the lwtseg6 related BPF ops can be invoked via bpftestrun without without entering inputactionendbpf first. Martin KaFai Lau said that self test for...

openSUSE 15 Security Update : gstreamer-plugins-bad (openSUSE-SU-2024:0305-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2024:0305-1 advisory. Adding references for already fixed vulnerability: - CVE-2023-50186: Fixed heap-based buffer overflow in the AV1 codec parser ZDI-CAN-22300,...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the fact that the per-CPU variable seg6bpfsrhstates::srh is never assigned in the self-check use case, but i...

Oracle Linux 9 : fence-agents (ELSA-2024-6726)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-6726 advisory. 4.10.0-62.5 - bundled setuptools: fix CVE-2024-6345 Resolves: RHEL-49657 Tenable has extracted the preceding description block directly from the Oracle Linux...

CVE-2024-45605 Improper authorization on deletion of user issue alert notifications in sentry

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert...

CVE-2024-45605 Improper authorization on deletion of user issue alert notifications in sentry

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert...

CVE-2024-45605 Improper authorization on deletion of user issue alert notifications in sentry

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert...

CVE-2024-45606

CVE-2024-45606 affects Sentry (self-hosted and SaaS). An authenticated user could mute alert rules across arbitrary organizations and projects using a known rule ID without membership or project permissions due to improper authorization checks. A fix was issued to scope authorization correctly; a...

CVE-2024-45606 Improper authorization on muting of alert rules in sentry

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and projects with a know rule ID. The user does not need to be a member of the organization or have permissions on the project. In our review, we...

Sentry improperly authorizes muting of alert rules

Impact An authenticated user can mute alert rules from arbitrary organizations and projects given a known given rule ID. The user does not need to be a member of the organization or have permissions on the project. In our review, we have identified no instances where alerts have been muted by...

GHSA-V345-W9F2-MPM5 Sentry improperly authorizes muting of alert rules

Impact An authenticated user can mute alert rules from arbitrary organizations and projects given a known given rule ID. The user does not need to be a member of the organization or have permissions on the project. In our review, we have identified no instances where alerts have been muted by...

GHSA-54M3-95J9-V89J Sentry improperly authorizes deletion of user issue alert notifications

Impact An authenticated user may delete user issue alert notifications for arbitrary users given a known alert ID. Patches A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert notifications. Sentry SaaS users do not need to take any action...

Sentry improperly authorizes deletion of user issue alert notifications

Impact An authenticated user may delete user issue alert notifications for arbitrary users given a known alert ID. Patches A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert notifications. Sentry SaaS users do not need to take any action...

PT-2024-31704

Name of the Vulnerable Software and Affected Versions: Sentry versions prior to 24.9.0 Description: Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can delete user issue alert notifications for arbitrary users given a known alert ID. A patch w...

PT-2024-31705

Name of the Vulnerable Software and Affected Versions: Sentry versions prior to 24.9.0 Description: Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and projects with a known rule ID, without...

RHEL 8 : thunderbird (RHSA-2024:6721)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:6721 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: 115.15/128.2 mozilla: Type confusion when lookin...

openSUSE 15 Security Update : htmldoc (openSUSE-SU-2024:0303-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2024:0303-1 advisory. - CVE-2024-45508: Fixed an out-of-bounds write in parseparagraph in ps-pdf.cxx because of an attempt to strip leading whitespace from a whitespace-only...

openSUSE 15 Security Update : htmldoc (openSUSE-SU-2024:0304-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2024:0304-1 advisory. - CVE-2024-45508: Fixed an out-of-bounds write in parseparagraph in ps-pdf.cxx because of an attempt to strip leading whitespace from a whitespace-only...