SUSE-SU-2022:0436-1 Security update for the Linux Kernel (Live Patch 11 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-5940 fixes several issues. The following security issues were fixed: - CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input bsc1195308. - CVE-2021-4083: Fixed a read-after-free memory flaw inside the garba...

GHSA-WXJ3-QWV4-CVFM Privilege Escalation in Docker

Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors...

EulerOS Virtualization 3.0.6.6 : avahi (EulerOS-SA-2022-1108)

According to the versions of the avahi packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avah...

EulerOS Virtualization 3.0.6.0 : avahi (EulerOS-SA-2022-1055)

According to the versions of the avahi packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avah...

log4j: deserialization of untrusted data in SocketServer

A flaw was discovered in Log4j, where a vulnerable SocketServer class may lead to the deserialization of untrusted data. This flaw allows an attacker to remotely execute arbitrary code when combined with a deserialization gadget...

Stormshield Network Security 访问控制错误漏洞

Stormshield Network Security is a next-generation UTM Unified Threat Management firewall from the French company Stormshield. A security vulnerability in Stormshield 1.1.0 and 2.1.0 through 2.9.0 could allow an attacker to block client access to the VPN and gain access to sensitive information...

Important: kernel

Issue Overview: A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was found in the way users call some interrupts with high frequency from one of the guests. A local user could use this flaw to starve the resources resulting in a denial of service...

CVE-2007-20001

A flaw was found in StarWind iSCSI target. An attacker could script standard iSCSI Initiator operations to exhaust the StarWind service socket, which could lead to denial of service. This affects iSCSI SAN Windows Native Version 3.2.2 build 2007-02-20...

StarWind iSCSI SAN 资源管理错误漏洞

StarWind iSCSI SAN is a kind of iSCSI storage from StarWind, USA. It is suitable for small and medium-sized businesses that need to store and transfer large amounts of data over a network. A resource management error vulnerability exists in versions prior to StarWind iSCSI SAN 3.5 build 2007-08-0...

PT-2022-7704 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the Linux kernel's handling of mixed splice/sendmsgMSG ZEROCOPY cases over the same TCP socket, which could trigger a warning in inet sock destruct. The problem...

SUSE SLES15 Security Update : kernel (Live Patch 0 for SLE 15 SP3) (SUSE-SU-2022:0293-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0293-1 advisory. - A vulnerability was found in Linux Kernel where refcount leak in llcpsockbind causing use-after-free which might lead to privilege escalation...

SUSE SLES15: kernel-livepatch-5_3_18-24_49-default / etc (SUSE-SU-2022:0291-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0291-1 advisory. This update for the Linux Kernel 5.3.18-2449 fixes several issues. The following security issues were fixed: - CVE-2022-0185: Incorrect param...

CLSA-2022-1643819084 Fix CVE(s): CVE-2022-23218, CVE-2022-23219

SECURITY UPDATE: buffer overflow in svcunixcreate - debian/patches/any/CVE-2022-23218.patch: check whether AFUNIX socket path length doesn't exceed storage size - CVE-2022-23218 SECURITY UPDATE: buffer overflow in clntcreate - debian/patches/any/CVE-2022-23219.patch: check whether AFUNIX socket...

CVE-2022-21724 Unchecked Class Instantiation when providing Plugin Classes

pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based o...

GHSA-V7WG-CPWC-24M4 pgjdbc Does Not Check Class Instantiation when providing Plugin Classes

Impact pgjdbc instantiates plugin instances based on class names provided via authenticationPluginClassName, sslhostnameverifier, socketFactory, sslfactory, sslpasswordcallback connection properties. However, the driver did not verify if the class implements the expected interface before...

The vulnerability of the Controller.class.php file on the high-performance PHP Workman server platform allows attackers to execute cross-site scripting attacks against Redis database management systems.

The vulnerability of the Controller.class.php file on the high-performance PHP Workman socket service platform is related to the lack of security measures for the web page structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

CVE-2021-22600

A double-free flaw was found in the Linux kernel’s packet protocol subsystem in the way a user call triggers the packetsetring function of the net/packet/afpacket.c. This flaw allows a local user to crash or escalate their privileges on the system. Mitigation Only users with access to the AFPACKE...

Mageia: Security Advisory (MGASA-2016-0233)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2019-0214)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Important: kernel

Issue Overview: A use-after-free flaw was found in the Linux kernel's NFC LLCP protocol implementation in the way the user performs manipulation with an unknown input for the llcpsockbind function. This flaw allows a local user to crash or escalate their privileges on the system. CVE-2020-25670 A...