net-snmp security update

5.9.1-13.0.1 - fix error index value when snmpget is used a proxy pass Orabug: 35010262 1:5.9.1-13.3 - fix CVE-2022-24805, CVE-2022-24806, CVE-2022-24807, CVE-2022-24808, CVE-2022-24809 and CVE-2022-24810 RHEL-32062...

CLSA-2024-1727289133 python3: Fix of 2 CVEs

CVE-2024-6232: remove backtracking when parsing tarfile headers - CVE-2024-7592: fix quadratic complexity in parsing "-quoted cookie values with backslashes...

CVE-2024-30128

creationtimestamp| type| source ---|---|--- 2024-09-25 17:41:14+00:00| seen| https://t.me/cvedetector/6326...

SUSE-SU-2024:3443-1 Security update for opensc

This update for opensc fixes the following issues: - CVE-2024-45620: Incorrect handling of the length of buffers or files in pkcs15init. bsc1230076 - CVE-2024-45619: Incorrect handling length of buffers or files in libopensc. bsc1230075 - CVE-2024-45618: Uninitialized values after incorrect or...

dovecot: very large headers can cause resource exhaustion when parsing message

A security issue was found in Dovecot. Very large headers can lead to resource exhaustion when parsing messages. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to the message-header-parser, it starts building up a "fullvalue" buffer out of th...

kernel: net: asix: add proper error handling of usb read errors

In the Linux kernel, the following vulnerability has been resolved: net: asix: add proper error handling of usb read errors Syzbot once again hit uninit value in asix driver. The problem still the same -- asixreadcmd reads less bytes, than was requested by caller. Since all read requests are...

kernel: asix: fix uninit-value in asix_mdio_read()

In the Linux kernel, the following vulnerability has been resolved: asix: fix uninit-value in asixmdioread asixreadcmd may read less than sizeofsmsr bytes and in this case smsr will be uninitialized. Fail log: BUG: KMSAN: uninit-value in asixcheckhostenable drivers/net/usb/asixcommon.c:82 inline...

kernel: vt_ioctl: fix array_index_nospec in vt_setactivate

A vulnerability was found in the Linux kernel's vtioctl subsystem, where the vtsetactivate function can lead to a transient integer underflow due to improper handling of the vsa.console value. The vulnerability arises when an out-of-bounds value is decreased before being sanitized using...

kernel: wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values

A vulnerability was found in the cfg80211 component in the Linux kernel, where a lack of proper range validation applied to the NL80211ATTRTXQQUANTUM can lead to a scenario where the userspace passes an extremely high value that the kernel is not designed to handle efficiently ex. 2^31. This can...

kernel: asix: fix uninit-value in asix_mdio_read()

In the Linux kernel, the following vulnerability has been resolved: asix: fix uninit-value in asixmdioread asixreadcmd may read less than sizeofsmsr bytes and in this case smsr will be uninitialized. Fail log: BUG: KMSAN: uninit-value in asixcheckhostenable drivers/net/usb/asixcommon.c:82 inline...

kernel: usb-storage: alauda: Check whether the media is initialized

In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Check whether the media is initialized The member "uzonesize" of struct alaudainfo will remain 0 if alaudainitmedia fails, potentially causing divide errors in alaudareaddata and alaudawritelba. - Add a membe...

The vulnerability of the Yokogawa Dual-redundant Platform for Computer (PC2CKM) lies in the improper checking of the return value of a method or function, allowing an attacker to trigger a service failure.

The vulnerability of the Yokogawa Dual-redundant Platform for Computer PC2CKM is related to improper checking of the return value of a method or function. Exploiting this vulnerability can allow an attacker, operating remotely, to cause a service failure by sending broadcast UDP packets...

CVE-2024-45614

Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies such as X-Forwarded-For by providing a underscore version of the same header X-ForwardedFor. Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 now...

nimbus-jose-jwt: large JWE p2c header value causes Denial of Service

A vulnerability was found in the Nimbus Jose JWT package. By crafting a JWE with an excessively large p2c value, an attacker can trigger significant resource consumption during decryption, potentially leading to application slowdown or unavailability...

SUSE CVE-2024-46725

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix out-of-bounds write warning Check the ring type value to fix the out-of-bounds write warning...

SUSE CVE-2024-46769

In the Linux kernel, the following vulnerability has been resolved: spi: intel: Add check devmkasprintf returned value intelspipopulatechip use devmkasprintf to set pdata-name. This can return a NULL pointer on failure but this returned value is not checked...

CVE-2024-31196

Unchecked Return Value to NULL Pointer Dereference vulnerability in Open Networking Foundation ONF libfluid libfluidmsg module. This vulnerability is associated with program routine fluidmsg::ActionList::unpack10. This issue affects libfluid: 0.1.0...

CVE-2024-31185

Unchecked Return Value to NULL Pointer Dereference vulnerability in Open Networking Foundation ONF libfluid libfluidmsg module. This vulnerability is associated with program routine fluidmsg::of13::MeterBandList::unpack. This issue affects libfluid: 0.1.0...

CVE-2024-31185

Unchecked Return Value to NULL Pointer Dereference vulnerability in Open Networking Foundation ONF libfluid libfluidmsg module. This vulnerability is associated with program routine fluidmsg::of13::MeterBandList::unpack. This issue affects libfluid: 0.1.0...

CVE-2024-31165

Unchecked Return Value to NULL Pointer Dereference vulnerability in Open Networking Foundation ONF libfluid libfluidmsg module. This vulnerability is associated with program routine fluidmsg::of13::SetFieldAction::unpack. This issue affects libfluid: 0.1.0...