PT-2024-40697 · Apache · Apache Commons Configuration2

Name of the Vulnerable Software and Affected Versions: Apache Commons Configuration2 affected versions not specified Description: The issue is related to a security exception in the org.apache.commons.configuration2 package. Specifically, the problem occurs in the...

CVE-2024-26918

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix active state requirement in PME polling The commit noted in fixes added a bogus requirement that runtime PM managed devices need to be in the RPMACTIVE state for PME polling. In fact, only devices in low power states...

CVE-2023-40146

A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 in QEMU. A specially crafted command line argument can lead to a limited-shell escape and elevated capabilities. An attacker can authenticate with hard-coded credentials and execute unblocke...

Cookie-Monster - BOF To Steal Browser Cookies & Credentials

Steal browser cookies for edge, chrome and firefox through a BOF or exe! Cookie-Monster will extract the WebKit master key, locate a browser process with a handle to the Cookies and Login Data files, copy the handles and then filelessly download the target. Once the Cookies/Login Data files are...

DEBIAN-CVE-2024-26901

In the Linux kernel, the following vulnerability has been resolved: dosysnametohandle: use kzalloc to fix kernel-infoleak syzbot identified a kernel information leak vulnerability in dosysnametohandle and issued the following report 1. 1 "BUG: KMSAN: kernel-infoleak in instrumentcopytouser...

UBUNTU-CVE-2024-26901

In the Linux kernel, the following vulnerability has been resolved: dosysnametohandle: use kzalloc to fix kernel-infoleak syzbot identified a kernel information leak vulnerability in dosysnametohandle and issued the following report 1. 1 "BUG: KMSAN: kernel-infoleak in instrumentcopytouser...

CVE-2024-26901 do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak

In the Linux kernel, the following vulnerability has been resolved: dosysnametohandle: use kzalloc to fix kernel-infoleak syzbot identified a kernel information leak vulnerability in dosysnametohandle and issued the following report 1. 1 "BUG: KMSAN: kernel-infoleak in instrumentcopytouser...

CVE-2024-26854 ice: fix uninitialized dplls mutex usage

In the Linux kernel, the following vulnerability has been resolved: ice: fix uninitialized dplls mutex usage The pf-dplls.lock mutex is initialized too late, after its first use. Move it to the top of icedpllinit. Note that the "errexit" error path destroys the mutex. And the mutex is the last...

CVE-2024-26854 ice: fix uninitialized dplls mutex usage

In the Linux kernel, the following vulnerability has been resolved: ice: fix uninitialized dplls mutex usage The pf-dplls.lock mutex is initialized too late, after its first use. Move it to the top of icedpllinit. Note that the "errexit" error path destroys the mutex. And the mutex is the last...

CVE-2024-26854 ice: fix uninitialized dplls mutex usage

In the Linux kernel, the following vulnerability has been resolved: ice: fix uninitialized dplls mutex usage The pf-dplls.lock mutex is initialized too late, after its first use. Move it to the top of icedpllinit. Note that the "errexit" error path destroys the mutex. And the mutex is the last...

MGASA-2024-0135 Updated nghttp2 packages fix security vulnerability

nghttp2 library keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. This update fixes the issue. This is the latest release, which will bring some more fixes and...

Updated nghttp2 packages fix security vulnerability

nghttp2 library keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. This update fixes the issue. This is the latest release, which will bring some more fixes and...

RHEL 8 / 9 : OpenShift Container Platform 4.14.4 (RHSA-2023:7473)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7473 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...

Mageia: Security Advisory (MGASA-2024-0135)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Excessive Resource Usage Verifying X.509 Policy Constraints (CVE-2023-0464)

A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of...

Denial Of Service (DoS)

SixLabors.ImageSharp is vulnerable to Denial of Service DoS. The vulnerability is caused by processing specially crafted files, which results in excessive memory usage during image decoding...

SUSE CVE-2024-26817

In the Linux kernel, the following vulnerability has been resolved: amdkfd: use calloc instead of kzalloc to avoid integer overflow This uses calloc instead of doing the multiplication which might overflow...

CVE-2024-32035

ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in image decoders. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit...

CVE-2024-32035 Memory Allocation with Excessive Size Value in SixLabors.ImageSharp

ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in image decoders. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit...

CVE-2024-32035

The CVE-2024-32035 entry concerns SixLabors.ImageSharp, a 2D graphics API. The vulnerability causes excessive memory usage in image decoders when processing specially crafted files, enabling a denial of service (DoS) by exhausting process memory. Affected is the ImageSharp decoding path as descri...