PT-2023-9170 · Miktex +4 · Miktex +4

Name of the Vulnerable Software and Affected Versions: LuaTeX versions prior to 1.17.0 TeX Live versions prior to 2023 r66984 MiKTeX versions prior to 23.5 Description: The issue allows a document, compiled with default settings, to make arbitrary network requests due to full access to the socket...

LuaTeX 安全漏洞

LuaTeX is an extended version of pdfTeX from LuaTeX, using Lua as the embedded scripting language. A security vulnerability exists in LuaTeX versions prior to 1.17.0, which stems from enabling the socket library by default...

UBUNTU-CVE-2022-36937

HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnerabilities and is deprecated. HHVM 4.153.4, 4.168.2, 4.169.2, 4.170.2, 4.171.1, 4.172.1, 4.173.0 replaces TLS1.0 with TLS1.3. Applications...

PT-2023-13512 · Facebook · Hhvm

Name of the Vulnerable Software and Affected Versions: HHVM versions 4.172.0 and all prior versions Description: The issue arises from HHVM using TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS 1.0 has numerous published vulnerabilities and is deprecated...

CVE-2023-24903

Windows Secure Socket Tunneling Protocol SSTP Remote Code Execution Vulnerability...

kernel: ip: Fix data-races around sysctl_ip_prot_sock.

In the Linux kernel, the following vulnerability has been resolved: ip: Fix data-races around sysctlipprotsock. sysctlipprotsock is accessed concurrently, and there is always a chance of data-race. So, all readers and writers need some basic protection to avoid load/store-tearing...

kernel: bpf, sockmap: Fix more uncharged while msg has more_data

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix more uncharged while msg has moredata In tcpbpfsendverdict, if msg has more data after tcpbpfsendmsgredir: tcpbpfsendverdict tosend = msg-sg.size //msg-sg.size = 22220 case SKREDIRECT: skmsgreturn //uncharged...

kernel: network backend may cause Linux netfront to use freed SKBs (XSA-405)

An incomplete cleanup flaw was found in the Linux kernel’s Xen networking XDP eXpress Data Path subsystem. This flaw allows a local user to crash the system...

kernel: ice: xsk: prohibit usage of non-balanced queue id

In the Linux kernel, the following vulnerability has been resolved: ice: xsk: prohibit usage of non-balanced queue id Fix the following scenario: 1. ethtool -L $IFACE rx 8 tx 96 2. xdpsock -q 10 -t -z Above refers to a case where user would like to attach XSK socket in txonly mode at a queue id...

kernel: skmsg: pass gfp argument to alloc_sk_msg()

A denial of service exists in the pass gfp argument to allocskmsg of the linux kernel, such that an attacker creating a specially crafted payload could result in damage to system availability...

kernel: net/tunnel: wait until all sk_user_data reader finish before releasing the sock

In the Linux kernel, the following vulnerability has been resolved: net/tunnel: wait until all skuserdata reader finish before releasing the sock There is a race condition in vxlan that when deleting a vxlan device during receiving packets, there is a possibility that the sock is released after...

kernel: Kernel: Denial of Service via memory leak in wifi power saving mode

A flaw was found in the Linux kernel's wifi driver. Under power saving mode, the driver fails to properly free unused socket buffers skb, leading to a memory leak. A local attacker could exploit this vulnerability to cause a Denial of Service DoS by exhausting system memory...

kernel: scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()

A flaw was found in the iSCSI TCP component in the Linux kernel. A race condition between releasing a socket and accessing it via sysfs can lead to a NULL pointer dereference when calling getpeername. This issue can cause a crash and result in a denial of service...

kernel: denial of service in tipc_conn_close

A data race flaw was found in the Linux kernel, between where con is allocated and con-sock is set. This issue leads to a NULL pointer dereference when accessing con-sock-sk in net/tipc/topsrv.c in the tipc protocol in the Linux kernel...

kernel: tipc: fix a null-ptr-deref in tipc_topsrv_accept

In the Linux kernel, the following vulnerability has been resolved: tipc: fix a null-ptr-deref in tipctopsrvaccept syzbot found a crash in tipctopsrvaccept: KASAN: null-ptr-deref in range 0x0000000000000008-0x000000000000000f Workqueue: tipcrcv tipctopsrvaccept RIP: 0010:kernelaccept+0x22d/0x350...

kernel: l2tp: close all race conditions in l2tp_tunnel_register()

In the Linux kernel, the following vulnerability has been resolved: l2tp: close all race conditions in l2tptunnelregister The code in l2tptunnelregister is racy in several ways: 1. It modifies the tunnel socket after publishing it. 2. It calls setupudptunnelsock on an existing socket without...

kernel: Kernel: Denial of Service via recursive deadlock in L2TP tunnel registration

A flaw was found in the kernel. A local user can exploit this vulnerability by passing a pppol2tp socket file descriptor as a UDP socket file descriptor during L2TP tunnel registration. This can cause a recursive deadlock, leading to a denial of service DoS on the system...

kernel: net: fix refcount bug in sk_psock_get (2)

In the Linux kernel, the following vulnerability has been resolved: net: fix refcount bug in skpsockget 2 Syzkaller reports refcount bug as follows: ------------ cut here ------------ refcountt: saturated; leaking memory. WARNING: CPU: 1 PID: 3605 at lib/refcount.c:19...

kernel: can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path

In the Linux kernel, the following vulnerability has been resolved: can: etases58x: es58xrxerrmsg: fix memory leak in error path In es58xrxerrmsg, if can-dosetmode fails, the function directly returns without calling netifrxskb. This means that the skb previously allocated by alloccanerrskb is no...

kernel: can: m_can: m_can_tx_handler(): fix use after free of skb

In the Linux kernel, the following vulnerability has been resolved: can: mcan: mcantxhandler: fix use after free of skb canputechoskb will clone skb then free the skb. Move the canputechoskb for the mcan version 3.0.x directly before the start of the xmit in hardware, similar to the 3.1.x branch...