AZL-53209 CVE-2024-10978 affecting package postgresql for versions less than 16.5-1

Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses...

ALPINE-CVE-2024-10978

Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses...

UBUNTU-CVE-2024-10976

Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invok...

CVE-2024-10978 PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID

Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses...

CVE-2024-10978

Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses...

CVE-2024-10978

Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses...

CVE-2024-10978: Incorrect Privilege Assignment

Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses...

FreeBSD : PostgreSQL -- SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (12e3feab-a29f-11ef-af48-6cc21735f730)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 12e3feab-a29f-11ef-af48-6cc21735f730 advisory. PostgreSQL project reports: Incorrect privilege assignment in PostgreSQL allows a less-privileged...

PostgreSQL -- SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID

PostgreSQL project reports: Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when...

CLSA-2024-1731524667 Fix CVE(s): CVE-2020-27755

SECURITY UPDATE: Memory leak due to incorrect image depth size check - debian/patches/CVE-2020-27755.patch: Fix image depth not supported error by setting depth to 8 if it is 0 and to maximum size if it exceeds limit - CVE-2020-27755...

xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability

A flaw was found in the X.org server. Due to improperly tracked allocation size in XkbSetCompatMap, a local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading to denial of service or local privilege escalation in distributions where the X.org serv...

Linux DRM AMD Display Kernel DoS

The vulnerability of components such as DRM, AMD, and display kernels in the Linux operating system is related to the assignment of the NULL pointer in the edpsetreplayallowactive function. Exploiting this vulnerability can allow a hacker to trigger a service failure...

s390/cio DoS

The vulnerability of the s390/cio component of the Linux operating system’s kernel is related to the state of the ccwdevicesetonline function. Exploiting this vulnerability can allow an attacker to gain increased privileges within the system...

November Patch Tuesday release contains three critical remote code execution vulnerabilities

The Patch Tuesday for November of 2024 includes 89 vulnerabilities, including four that Microsoft marked as "critical." The remaining vulnerabilities listed are classified as "important." Microsoft assessed that exploitation of the four "critical" vulnerabilities is "less likely." CVE-2024-43639 ...

kernel: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type Lion Ackermann reported that there is a race condition between namespace cleanup in ipset and the garbage collection of the list:set type. The...

kernel: dma-direct: Leak pages on dma_set_decrypted() failure

In the Linux kernel, the following vulnerability has been resolved: dma-direct: Leak pages on dmasetdecrypted failure The Linux kernel CVE team has assigned CVE-2024-35939 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051919-CVE-2024-35939-f877@gregkh/T...

kernel: net/bluetooth: race condition in {conn,adv}_{min,max}_interval_set() function

A race condition flaw was found in the Linux kernel's net/bluetooth, specifically in the conn,advmin,maxintervalset function, which may disrupt I2cap connections, possibly causing a denial of service. This flaw allows an attacker to disrupt Bluetooth connections, leading to a potential denial of...

kernel: drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'

A NULL pointer dereference flaw was found in the Linux kernel in dcn21setpipe. This issue may lead to a crash...

kernel: pwm: Fix double shift bug

REJECTED CVE A double shift vulnerability was identified in the Linux kernel's pwm subsystem. The issue involves passing a shifted value instead of a bit number to set/testbit functions, resulting in a double shift e.g., BITBIT1. While this doesn't cause problems for values 0 or 1, values of 5 or...

kernel: igb: Fix string truncation warnings in igb_set_fw_version

In the Linux kernel, the following vulnerability has been resolved: igb: Fix string truncation warnings in igbsetfwversion Commit 1978d3ead82c "intel: fix string truncation warnings" fixes '-Wformat-truncation=' warnings in igbmain.c by using kasprintf...