CLSA-2024-1726655093 kernel: Fix of 8 CVEs

blktrace: fix dereference after null check CVE-2019-19768 - blktrace: Protect q-blktrace with RCU CVE-2019-19768 - blktrace: fix unlocked access to init/start-stop/teardown - blktrace: Fix potential deadlock between delete & sysfs ops - net: fix out-of-bounds access in opsinit CVE-2024-36883 -...

rteval bug fix update

An update is available for rteval. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The rteval packages contain a utility for measuring realtime scheduler latency...

SUSE-SU-2024:3186-1 Security update for buildah

This update for buildah fixes the following issues: Update to version 1.35.4: CVE-2024-3727 updates bsc1224117 Bump go-jose CVE-2024-28180 Bump ocicrypt and go-jose CVE-2024-28180 Update to version 1.35.3: correctly configure /etc/hosts and resolv.conf buildah: refactor resolv/hosts setup. rename...

UBUNTU-CVE-2024-7652

An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory corruption and an exploitable crash. This vulnerability affects Firefox 128, Firefox ESR 115.13, Thunderbird 115.13, and Thunderbird 128...

CVE-2024-41079 nvmet: always initialize cqe.result

In the Linux kernel, the following vulnerability has been resolved: nvmet: always initialize cqe.result The spec doesn't mandate that the first two double words aka results for the command queue entry need to be set to 0 when they are not used not specified. Though, the target implemention return...

CVE-2024-41035 USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor

In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor Syzbot has identified a bug in usbcore see the Closes: tag below caused by our assumption that the reserved bits in an endpoint descriptor's...

OPENSUSE-SU-2024:14152-1 python310-openapi-spec-validator-0.7.1-1.3 on GA media

These are all security issues fixed in the python310-openapi-spec-validator-0.7.1-1.3 package on the GA media of openSUSE Tumbleweed...

DEBIAN-CVE-2022-48735

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix UAF of leds class devs at unbinding The LED class devices that are created by HD-audio codec drivers are registered via devmledclassdevregister and associated with the HD-audio codec device. Unfortunately, it turne...

PT-2024-27675 · Unknown · Strongshop

Name of the Vulnerable Software and Affected Versions: StrongShop version 1.0 Description: A reflected cross-site scripting XSS issue was found, which can be exploited via the spec group id parameter at the "/spec/index.blade.php" API endpoint. Recommendations: For StrongShop version 1.0, avoid...

StrongShop Cross-Site Scripting Vulnerability

StrongShop is a free and open source cross-border e-commerce mall website by StrongShop Open Source. A cross-site scripting vulnerability exists in StrongShop v1.0, which originates from a cross-site scripting vulnerability in the specgroupid parameter on /spec/index.blade.php...

CVE-2024-37619

StrongShop v1.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the specgroupid parameter at /spec/index.blade.php...

OPENSUSE-SU-2024:11247-1 python36-openapi-spec-validator-0.2.9-1.5 on GA media

These are all security issues fixed in the python36-openapi-spec-validator-0.2.9-1.5 package on the GA media of openSUSE Tumbleweed...

Oracle Linux 9 : cockpit (ELSA-2024-3843)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-3843 advisory. 311.2-1.0.1 - Replaced upstream urls in documentation with oracle links Orabug: 36528753 - Drop subscription-manager-cockpit requirement for ol Orabug: 34681110...

CVE-2024-5699

In violation of spec, cookie prefixes such as Secure were being ignored if they were not correctly capitalized - by spec they should be checked with a case-insensitive comparison. This could have resulted in the browser not correctly honoring the behaviors specified by the prefix. This...

CVE-2024-5699

In violation of spec, cookie prefixes such as Secure were being ignored if they were not correctly capitalized - by spec they should be checked with a case-insensitive comparison. This could have resulted in the browser not correctly honoring the behaviors specified by the prefix. This...

CVE-2024-5699

In violation of spec, cookie prefixes such as Secure were being ignored if they were not correctly capitalized - by spec they should be checked with a case-insensitive comparison. This could have resulted in the browser not correctly honoring the behaviors specified by the prefix. This...

CVE-2024-5699

CVE-2024-5699 affects Mozilla Firefox prior to version 127. The issue arises from cookie prefixes such as __Secure being ignored when capitalization isn’t correct, contrary to the spec that requires a case-insensitive check. This could allow behaviors not being honored as defined by the prefix, w...

CVE-2024-5699

In violation of spec, cookie prefixes such as Secure were being ignored if they were not correctly capitalized - by spec they should be checked with a case-insensitive comparison. This could have resulted in the browser not correctly honoring the behaviors specified by the prefix. This...

cockpit security update

311.2-1.0.1 - Replaced upstream urls in documentation with oracle links Orabug: 36528753 - Drop subscription-manager-cockpit requirement for ol Orabug: 34681110 - Remove duplicate reference to server in cockpit Orabug: 34030494 - Update documentation links Orabug: 30271413, Orabug: 32013095,...

Malicious code in mapbox-demo-gl-style-spec (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fa5a509685be972fc15ceb454b2c3768fd8dd7c5162f11471642ab34e1f34fb9 The OpenSSF Package Analysis project identified 'mapbox-demo-gl-style-spec' @ 14.4.0 npm as malicious. It is considered malicious because: - The...