A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys allowing them to decrypt each other's tickets. A user who has been requested to change their password can exploit this flaw to obtain and use tickets to other services.

...

Low: runc

Issue Overview: runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between t...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-44966)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-44966 advisory. - In the Linux kernel, the following vulnerability has been resolved: binfmtflat: Fix corruption when not...

PT-2024-33216 · Wanxing Technology · Wanxing Technology Yitu Project Management Kirin Edition

Name of the Vulnerable Software and Affected Versions: Wanxing Technology Yitu Project Management Kirin Edition version 2.3.6 Description: The issue allows a remote attacker to execute arbitrary code via a specially constructed so file in /opt/EdrawProj-2/plugins/imageformat. This enables the...

Debian dla-3919 : libapache-mod-jk-doc - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3919 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3919-1 [email protected] https://www.debian.org/lts/security/...

OESA-2024-2253 runc security update

runc is a CLI tool for spawning and running containers according to the OCI specification. Security Fixes: runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files...

OESA-2024-2229 apr security update

The mission of the Apache Portable Runtime APR project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of...

soc: qcom: cmd-db: Map shared memory as WC not WB

...

The vulnerability of the Windows operating system’s kernel allows attackers to enhance their privileges.

The vulnerability of the Windows operating system’s kernel is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to increase their privileges...

[SECURITY] Fedora 40 Update: koji-1.35.1-1.fc40

Koji is a system for building and tracking RPMS. The base package contains shared libraries and the command-line interface...

DEBIAN-CVE-2024-47813

Wasmtime is an open source runtime for WebAssembly. Under certain concurrent event orderings, a wasmtime::Engine's internal type registry was susceptible to double-unregistration bugs due to a race condition, leading to panics and potentially type registry corruption. That registry corruption...

PT-2024-6726

Name of the Vulnerable Software and Affected Versions: Windows Kernel affected versions not specified Description: An elevation-of-privilege vulnerability exists within the Windows kernel due to synchronization errors when a shared resource is used. Successful exploitation of this issue may allow...

PT-2024-6965 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7-p2 through 2.4.4-p10 and earlier Description: The issue is related to a Time-of-check Time-of-use TOCTOU Race Condition vulnerability that could lead to a security feature bypass. An attacker could exploit this...

Malicious code in @linx-ui/shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a70dd8ec71455f4177650ed33f72b8da1f8067e2afbebd634836da68f44cbc53 The OpenSSF Package Analysis project identified '@linx-ui/shared' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2023-37822

The Eufy Homebase 2 before firmware version 3.3.4.1h creates a dedicated wireless network for its ecosystem, which serves as a proxy to the end user's primary network. The WPA2-PSK generation of this dedicated network is flawed and solely based on the serial number. Due to the flawed generation...

CVE-2024-0116

A flaw was found in the NVIDIA Triton Inference Server. Affected versions of Triton Inference Server contain a vulnerability where a user may cause an out-of-bounds read issue by releasing a shared memory region while it is in use, possibly leading to denial of service. Mitigation Mitigation for...

undertow: Improper State Management in Proxy Protocol parsing causes information leakage

A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the...

CVE-2024-0116

NVIDIA Triton Inference Server contains a vulnerability where a user may cause an out-of-bounds read issue by releasing a shared memory region while it is in use. A successful exploit of this vulnerability may lead to denial of service...

CVE-2024-0116

NVIDIA Triton Inference Server contains a vulnerability where a user may cause an out-of-bounds read issue by releasing a shared memory region while it is in use. A successful exploit of this vulnerability may lead to denial of service...

CVE-2024-0116

NVIDIA Triton Inference Server contains a vulnerability where a user may cause an out-of-bounds read issue by releasing a shared memory region while it is in use. A successful exploit of this vulnerability may lead to denial of service...