Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2024-707)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-707 advisory. NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpmp4module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4...

OESA-2024-2092 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: ASN.1 strings are represented internally within OpenSSL as an ASN1STRING structure which contains a buffer holding the string data and a field holding the buffer...

OESA-2024-2094 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: ASN.1 strings are represented internally within OpenSSL as an ASN1STRING structure which contains a buffer holding the string data and a field holding the buffer...

OESA-2024-2093 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: ASN.1 strings are represented internally within OpenSSL as an ASN1STRING structure which contains a buffer holding the string data and a field holding the buffer...

The vulnerability of Asterisk IP-telephony management systems and Certified Asterisk, related to errors in sending SIP requests to URIs, allows attackers to trigger an emergency termination of the application’s operation.

The vulnerability of Asterisk IP-telephony systems and Certified Asterisk is related to errors in sending SIP requests with URIs. Exploiting this vulnerability can allow a malicious actor to cause service failures and terminate operations remotely...

CVE-2024-45288

A missing null-termination character in the last element of an nvlist array string can lead to writing outside the allocated buffer...

CVE-2024-45288 Multiple vulnerabilities in libnv

A missing null-termination character in the last element of an nvlist array string can lead to writing outside the allocated buffer...

CVE-2024-45288 Multiple vulnerabilities in libnv

A missing null-termination character in the last element of an nvlist array string can lead to writing outside the allocated buffer...

CVE-2024-45288

CVE-2024-45288 is a vulnerability in FreeBSD libnv (nvlist) where a missing null-termination in the last element of an nvlist array string can cause writing outside the allocated buffer, potentially allowing memory corruption and privilege escalation. The FreeBSD security advisory SA-24:09.libnv ...

OpenSSL DoS Vulnerability (20240903) - Windows

OpenSSL is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openssl:openssl";...

PT-2024-31540 · Freebsd · Freebsd

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A missing null-termination character in the last element of an nvlist array string can lead to writing outside the allocated buffer. Recommendations: At...

CVE-2024-6119

Issue summary: Applications performing certificate name checks e.g., TLS clients checking server certificates may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of...

CVE-2024-6119 Possible denial of service in X.509 name checks

Issue summary: Applications performing certificate name checks e.g., TLS clients checking server certificates may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of...

CVE-2024-6119 Possible denial of service in X.509 name checks

Issue summary: Applications performing certificate name checks e.g., TLS clients checking server certificates may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of...

CVE-2024-6119

OpenSSL CVE-2024-6119 causes a denial of service when applications perform certificate name checks (e.g., TLS server name validation). The issue stems from reading an invalid memory address during name comparison (e.g., otherName in X.509) and may terminate the process. Multiple connected advisor...

kernel: wifi: iwlwifi: dbg-tlv: ensure NUL termination

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dbg-tlv: ensure NUL termination The Linux kernel CVE team has assigned CVE-2024-35845 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051718-CVE-2024-35845-65bd@gregkh/T...

New Rust-Based Ransomware Cicada3301 Targets Windows and Linux Systems

Cybersecurity researchers have unpacked the inner workings of a new ransomware variant called Cicada3301 that shares similarities with the now-defunct BlackCat aka ALPHV operation. "It appears that Cicada3301 ransomware primarily targets small to medium-sized businesses SMBs, likely through...

CVE-2023-52887

In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: enhanced error handling for tightly received RTS messages in xtprxrtssessionnew This patch enhances error handling in scenarios with RTS Request to Send messages arriving closely. It replaces the less informative...

OpenSSL -- Multiple vulnerabilities

The OpenSSL project reports: Possible denial of service in X.509 name checks Moderate severity Applications performing certificate name checks e.g., TLS clients checking server certificates may attempt to read an invalid memory address resulting in abnormal termination of the application process...

OpenSSL 安全漏洞

OpenSSL is an open source general-purpose cryptographic library capable of implementing the Secure Sockets Layer SSLv2/v3 and Secure Transport Layer TLSv1 protocols from the OpenSSL team. It supports a variety of cryptographic algorithms, including symmetric ciphers, hashing algorithms, secure...