CVE-2024-26583 tls: fix race between async notify and socket close

In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread one which called recvmsg/sendmsg may exit as soon as the async crypto handler calls complete so any code past that point risks touching already freed data...

[SECURITY] Fedora 38 Update: syncthing-1.27.3-1.fc38

Syncthing replaces other file synchronization services with something open, trustworthy and decentralized. Your data is your data alone and you deserve to choose where it is stored, if it is shared with some third party and how it's transmitted over the Internet. Using syncthing, that control is...

[SECURITY] Fedora 39 Update: syncthing-1.27.3-1.fc39

Syncthing replaces other file synchronization services with something open, trustworthy and decentralized. Your data is your data alone and you deserve to choose where it is stored, if it is shared with some third party and how it's transmitted over the Internet. Using syncthing, that control is...

CVE-2024-26585: Concurrent Execution using Shared Resource with Improper Synchronization

In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work scheduling and socket close Similarly to previous commit, the submitting thread recvmsg/sendmsg may exit as soon as the async crypto handler calls complete. Reorder scheduling the work before calling...

UBUNTU-CVE-2023-52433

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetrbtree: skip sync GC for new elements in this transaction New elements in this transaction might expired before such transaction ends. Skip sync GC for such elements otherwise commit path might walk over an alrea...

CVE-2023-47634: Concurrent Execution using Shared Resource with Improper Synchronization

Decidim is a participatory democracy framework. Starting in version 0.10.0 and prior to versions 0.26.9, 0.27.5, and 0.28.0, a race condition in the endorsement of resources for instance, a proposal allows a user to make more than once endorsement. To exploit this vulnerability, the request to se...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a problem with the netfilter module that could lead to the skipping of the synchronization GC for new elemen...

Windows Message Queuing Privilege Escalation

The vulnerability of Windows’ Message Queuing system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to gain increased privileges...

Windows kernel Privilege Escalation

The vulnerability of the Windows operating system’s kernel is related to synchronization errors when using a shared resource „Race Conditions“. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2024-25468

An issue in TOTOLINK X5000R V.9.1.0u.6369B20230113 allows a remote attacker to cause a denial of service via the hosttime parameter of the NTPSyncWithHost component...

CVE-2024-26260

The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission...

CVE-2024-26260

The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission...

CVE-2024-26260 Hgiga OAKlouds - Command Injection

The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission...

CVE-2024-26260 Hgiga OAKlouds - Command Injection

The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission...

CVE-2024-26260

HGiga OAKlouds is affected by an OS command injection in the synchronization function of certain modules, enabling remote command execution via specific request parameters. Root cause is input/sanitization in those parameters leading to arbitrary code execution on the server; CVSS v3.1 base score...

CVE-2024-22389

When BIG-IP is deployed in high availability HA and an iControl REST API token is updated, the change does not sync to the peer device. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

F5 BIG-IP Security Vulnerabilities

F5 BIG-IP is an application delivery platform from F5 Corporation that integrates network traffic management, application security management, and load balancing. A security vulnerability exists in the F5 BIG-IP that originates when the BIG-IP is deployed with High Availability HA and an iControl...

PT-2024-1728

Name of the Vulnerable Software and Affected Versions Microsoft Message Queuing MSMQ affected versions not specified Description The issue is related to synchronization errors when using a shared resource in the Windows operating system's message queuing component. This can allow an attacker to...

Unbreakable Enterprise kernel security update

5.15.0-203.146.5.1 - Revert 'selftests/bpf: Test tail call counting with bpf2bpf and data on stack' Samasth Norway Ananda Orabug: 36277693 - Revert 'tcp: fix excessive TLP and RACK timeouts from HZ rounding' Sherry Yang Orabug: 36277684 5.15.0-203.146.5 - i2c: core: Fix atomic xfer check for...

PT-2024-1848

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a synchronization error when using a shared resource in the Linux kernel's tls encrypt done function. This can lead to a denial of service. The problem arises fro...