[SECURITY] Fedora 39 Update: glibc-2.38-18.fc39

The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make upgrading easier, common system code is kept in one place and shared between programs. This particular package contains the most important se...

The vulnerability of the Avalanche device management system, related to synchronization errors when using a common resource (“Race Situation”), allows a hacker to execute arbitrary commands with SYSTEM privileges.

The vulnerability of the Avalanche device management system is related to synchronization errors when using a common resource “Race Situation”. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with SYSTEM privileges...

kernel: veth: ensure skb entering GRO are not cloned.

In the Linux kernel, the following vulnerability has been resolved: veth: ensure skb entering GRO are not cloned. After commit d3256efd8e8b "veth: allow enabling NAPI even without XDP", if GRO is enabled on a veth device and TSO is disabled on the peer device, TCP skbs will go through the NAPI...

WordPress Shared Files plugin <= 1.7.16 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Shared Files versions = 1.7.16...

CVE-2024-26892 wifi: mt76: mt7921e: fix use-after-free in free_irq()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921e: fix use-after-free in freeirq From commit a304e1b82808 "PATCH Debug shared irqs", there is a test to make sure the shared irq handler should be able to handle the unexpected event after deregistration. For th...

WordPress Shared Files Plugin <= 1.7.16 is vulnerable to Broken Access Control

Software Shared Files Type Plugin Vulnerable versions = 1.7.16 Fixed in 1.7.17 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32679 Patch priority Low CVSS severity Low 5.3 Developer Tammersoft PSID a4b252f2d162 Credits Dhabaleshwar Das Required privilege...

Fedora 39 : mbedtls (2024-666210bd74)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-666210bd74 advisory. - Update to 2.28.8 Release notes: https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.8 Tenable has extracted the preceding description block...

The vulnerability in the implementation of the Secure Boot protocol for operating systems with Windows, which allows attackers to circumvent existing security restrictions.

The vulnerability of the Secure Boot protocol for Windows operating systems is related to synchronization errors when using a common resource “Race Situation”. Exploiting this vulnerability can allow an attacker to circumvent existing security restrictions remotely...

CVE-2024-30387

A Missing Synchronization vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS on ACX5448 and ACX710 allows an unauthenticated, adjacent attacker to cause a Denial-of-Service DoS. If an interface flaps while the system gathers statistics on that interface, two processes...

CVE-2024-30387 Junos OS: ACX5448 & ACX710: Due to interface flaps the PFE process can crash

A Missing Synchronization vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS on ACX5448 and ACX710 allows an unauthenticated, adjacent attacker to cause a Denial-of-Service DoS. If an interface flaps while the system gathers statistics on that interface, two processes...

OESA-2024-1409 libreswan security update

Libreswan is an implementation of IKEv1 and IKEv2 for IPsec. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks. Everything passing through the...

USN-6730-1 maven-shared-utils vulnerability

It was discovered that Apache Maven Shared Utils did not handle double-quoted strings properly, allowing shell injection attacks. This could allow an attacker to run arbitrary code...

USN-6730-1: Apache Maven Shared Utils vulnerability

It was discovered that Apache Maven Shared Utils did not handle double-quoted strings properly, allowing shell injection attacks. This could allow an attacker to run arbitrary code...

PT-2024-27203

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In CoCo VMs, it is possible for the untrusted host to cause set memory encrypted or set memory decrypted to fail, resulting in shared memory. Callers need to handle these errors to avoid...

PT-2024-3296 · Microsoft · Windows Distributed File System +1

Name of the Vulnerable Software and Affected Versions: Windows Distributed File System DFS affected versions not specified Description: The issue is related to synchronization errors in the Windows Distributed File System DFS, specifically a "race condition" situation when using a shared resource...

PT-2024-3310 · Microsoft · Windows Server +2

Name of the Vulnerable Software and Affected Versions: Microsoft Brokering File System affected versions not specified Description: The issue is related to errors in synchronization when using a shared resource in the Windows Server operating system. It allows an attacker to elevate their...

The vulnerability of the Nix package manager in Unix operating systems, related to synchronization errors when using shared resources, allows a perpetrator to modify the output of package processes in the Nix store.

The vulnerability of the Nix package manager in Unix operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability allows a remote attacker to modify the output of package processes in the Nix store...

The vulnerability of the kernel of iOS operating systems, macOS Sonoma, iPadOS, tvOS, visionOS, and watchOS allows attackers to disclose protected information.

The vulnerability of the kernel of iOS, macOS Sonoma, iPadOS, tvOS, visionOS, and watchOS is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow attackers to disclose sensitive information that is protected by these systems...

Sensitive Information Disclosure

libmbedtls.so is vulnerable to Sensitive Information Disclosure. The vulnerability is due to inadequate handling of shared memory within the PSA Crypto API, potentially leading to information disclosure...

The vulnerability of Intel microprogramming software, related to synchronization errors when using shared resources, allows attackers to exploit their privileges.

The vulnerability of Intel microprogramming software is related to synchronization errors when using common resources. Exploiting this vulnerability can allow attackers to increase their privileges...