CVE-2024-36975 KEYS: trusted: Do not use WARN when encode fails

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Do not use WARN when encode fails When asn1encodesequence fails, WARN is not the correct solution. 1. asn1encodesequence is not an internal function located in lib/asn1encode.c. 2. Location is known, which makes th...

The vulnerability of the tpm2_key_encode() function of the Trusted Platform Module (TPM) in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the tpm2keyencode function in the security/keys/trusted-keys/trustedtpm2.c file of the Trusted Platform Module TPM subsystem of the Linux kernel is related to a memory leak. Exploiting this vulnerability could allow an attacker to trigger a service failure...

CVE-2024-34451

Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different values. NOTE: the vendor's position is that Ghost should be installed with a reverse proxy that allows only trusted X-Forwarded-For headers...

OPENSUSE-SU-2024:12883-1 arm-trusted-firmware-2.8.6-1.1 on GA media

These are all security issues fixed in the arm-trusted-firmware-2.8.6-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10633-1 arm-trusted-firmware-2.5-2.3 on GA media

These are all security issues fixed in the arm-trusted-firmware-2.5-2.3 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11935-1 arm-trusted-firmware-2.6-8.1 on GA media

These are all security issues fixed in the arm-trusted-firmware-2.6-8.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-36967

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix memory leak in tpm2keyencode 'scratch' is never freed. Fix this by calling kfree in the success, and in the error case...

Google Pixel Security Breach

Google Pixel is a smartphone from Google, an American company. A security vulnerability exists in Google Pixel, which stems from the presence of uninitialized data in the handlemsgshmmapreq module of trusty/user/base/lib/spi/srv/tipc/tipc.c, which could allow for stack data disclosure...

CVE-2024-2747

CWE-428: Unquoted search path or element vulnerability exists in Easergy Studio, which could cause privilege escalation when a valid user replaces a trusted file name on the system and reboots the machine...

CVE-2024-2747

CWE-428: Unquoted search path or element vulnerability exists in Easergy Studio, which could cause privilege escalation when a valid user replaces a trusted file name on the system and reboots the machine...

CVE-2024-2747

CVE-2024-2747 affects Schneider Electric Easergy Studio. The root cause is CWE-428: an unquoted search path/element, allowing a local attacker with low privileges to escalate privileges by replacing a trusted file name and rebooting the system. Impact is described as high for confidentiality, int...

CVE-2024-36263

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: all versions. As this project is retired, we do not plan to release a version that fixes thi...

CVE-2024-36265 Apache Submarine Server Core: authorization bypass

UNSUPPORTED WHEN ASSIGNED Incorrect Authorization vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: from 0.8.0. An attacker can bypass authentication by sending specially crafted REST requests. As this project is retired, we do not plan to release a...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ubi: Fix race condition between ctrlcdevioctl and ubicdevioctl CVE-2021-47634 A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write. This flaw allows a local user t...

CVE-2024-28021

A vulnerability exists in the FOXMAN-UN/UNEM server that affects the message queueing mechanism’s certificate validation. If exploited an attacker could spoof a trusted entity causing a loss of confidentiality and integrity...

SUSE CVE-2024-36967

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix memory leak in tpm2keyencode 'scratch' is never freed. Fix this by calling kfree in the success, and in the error case...

Moby (Docker Engine) is vulnerable to Ambiguous OCI manifest parsing

Impact In the OCI Distribution Specification version 1.0.0 and prior and in the OCI Image Specification version 1.0.1 and prior, manifest and index documents are ambiguous without an accompanying Content-Type HTTP header. Versions of Moby Docker Engine prior to 20.10.11 treat the Content-Type...

`docker cp` allows unexpected chmod of host files in Moby Docker Engine

Impact A bug was found in Moby Docker Engine where attempting to copy files using docker cp into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read,...

DEBIAN-CVE-2024-36967

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix memory leak in tpm2keyencode 'scratch' is never freed. Fix this by calling kfree in the success, and in the error case...

UBUNTU-CVE-2024-36967

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix memory leak in tpm2keyencode 'scratch' is never freed. Fix this by calling kfree in the success, and in the error case...