Fedora: Security Advisory for disruptor (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: naga-3.0-26.20200930git6f1e95d.fc40

Naga aims to be a very small NIO library that provides a handful of java classes to wrap the usual Socket and ServerSocket with asynchronous NIO counterparts similar to NIO2 planned for Java 1.7. All of this is driven from a single thread, making it useful for both client e.g. allowing I/O to be...

[SECURITY] Fedora 40 Update: jcip-annotations-1-43.20060626.fc40

This package provides class, field, and method level annotations for describing thread-safety policies. These annotations are relatively unintrusive and are beneficial to both users and maintainers. Users can see immediately whether a class is thread-safe, and maintainers can see immediately...

BIT-WILDFLY-2020-10718

A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thread Context Classloader TCCL. This setting is exposed as a public method, which can bypass the security manager. The highest threat from this vulnerability is ...

SUSE CVE-2023-52572

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix UAF in cifsdemultiplexthread There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2isnetworknamedeleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd...

Warning: Thread Hijacking Attack Targets IT Networks, Stealing NTLM Hashes

The threat actor known as TA577 has been observed using ZIP archive attachments in phishing emails with an aim to steal NT LAN Manager NTLM hashes. The new attack chain "can be used for sensitive information gathering purposes and to enable follow-on activity," enterprise security firm Proofpoint...

PT-2024-26748

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue arises from the direct call to md reap sync thread from raid message without holding the reconfig mutex. This is unsafe because md reap sync thread can change fields protected ...

PT-2024-20367 · Rt-Thread · Rt-Thread

Name of the Vulnerable Software and Affected Versions: RT-Thread versions through 5.0.2 Description: A heap buffer overflow occurs in dfs v2 dfs file in RT-Thread. Recommendations: For RT-Thread versions through 5.0.2, at the moment, there is no information about a newer version that contains a f...

PT-2024-20918 · Rt-Thread · Rt-Thread

Name of the Vulnerable Software and Affected Versions: RT-Thread versions through 5.0.2 Description: A stack buffer overflow occurs in the net/at/src/at server.c file. Recommendations: For RT-Thread versions through 5.0.2, update to a version that contains a fix for this issue...

PT-2024-20920 · Rt-Thread · Rt-Thread

Name of the Vulnerable Software and Affected Versions: RT-Thread versions through 5.0.2 Description: A buffer overflow occurs in the utilities/rt-link/src/rtlink.c file. Recommendations: For RT-Thread versions through 5.0.2, update to a version that contains a fix for this issue. At the moment,...

PT-2024-20368 · Rt-Thread · Rt-Thread

Name of the Vulnerable Software and Affected Versions: RT-Thread versions 5.0.2 and earlier Description: A heap buffer overflow occurs in the dfs v2 romfs filesystem. Recommendations: For RT-Thread versions 5.0.2 and earlier, at the moment, there is no information about a newer version that...

PT-2024-20912 · Rt-Thread · Rt-Thread

Name of the Vulnerable Software and Affected Versions: RT-Thread versions through 5.0.2 Description: The issue is related to an integer signedness error and resultant buffer overflow in the drivers/wlan/wlan mgmt,c component. Recommendations: For RT-Thread versions through 5.0.2, update to a...

PT-2024-20916 · Rt-Thread · Rt-Thread

Name of the Vulnerable Software and Affected Versions: RT-Thread versions through 5.0.2 Description: A stack buffer overflow occurs in the libc/posix/ipc/mqueue.c file. Recommendations: For RT-Thread versions through 5.0.2, at the moment, there is no information about a newer version that contain...

PT-2024-26743

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the dm-raid component in the Linux kernel, where the sync thread is not properly frozen during suspend. This is caused by the removal of the MD RECOVERY FROZEN fl...

PT-2024-20915 · Rt-Thread · Rt-Thread

Name of the Vulnerable Software and Affected Versions: RT-Thread versions through 5.0.2 Description: A heap buffer overflow occurs in finsh/msh file.c and finsh/msh.c. Recommendations: For RT-Thread versions through 5.0.2, update to a version later than 5.0.2 to resolve the issue...

PT-2024-20917 · Rt-Thread · Rt-Thread

Name of the Vulnerable Software and Affected Versions: RT-Thread versions through 5.0.2 Description: An out-of-bounds access occurs in utilities/var export/var export.c. Recommendations: For RT-Thread versions through 5.0.2, update to a version that fixes the out-of-bounds access issue in...

PT-2024-20919 · Rt-Thread · Rt-Thread

Name of the Vulnerable Software and Affected Versions: RT-Thread versions through 5.0.2 Description: A buffer overflow occurs in utilities/ymodem/ry sy.c because of an incorrect sprintf call or a missing '0' character. Recommendations: For versions through 5.0.2, update to a version that fixes th...

PT-2024-20913 · Rt-Thread · Rt-Thread

Name of the Vulnerable Software and Affected Versions: RT-Thread versions through 5.0.2 Description: The issue is related to a weak random number generation algorithm used in RT-Thread. The algorithm, defined as seed = 214013L seed + 2531011L; return seed 16 & 0x7FFF;, is implemented in the calc...

CLSA-2024-1709562163 Fix CVE(s): CVE-2023-50387, CVE-2023-50868

SECURITY UPDATE: KeyTrap denial of service vulnerability - debian/patches/CVE-2023-50387-20230-50868.patch: Fix DNSSEC verification complexity issue by updating verification function signatures. - debian/patches/CVE-2023-50387-fix-1.patch: Allow the original CVE-2023-50387 patch to work if multip...

DEBIAN-CVE-2023-52572

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix UAF in cifsdemultiplexthread There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2isnetworknamedeleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd...