ansible-core-2.17-2.17.7-1.1 on GA media (moderate)

ansible-core-2.17-2.17.7-1.1 on GA media Announcement ID: openSUSE-SU-2024:14547-1 Rating: moderate Cross-References: CVE-2024-11079 CVSS scores: CVE-2024-11079 SUSE : 5.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L CVE-2024-11079 SUSE : 2...

CVE-2024-53137

In the Linux kernel, the following vulnerability has been resolved: ARM: fix cacheflush with PAN It seems that the cacheflush syscall got broken when PAN for LPAE was implemented. User access was not enabled around the cache maintenance instructions, causing them to fault...

CVE-2024-49419

creationtimestamp| type| source ---|---|--- 2024-12-03 06:25:41+00:00| seen| https://infosec.exchange/users/cve/statuses/113587463163015231 2024-12-03 08:08:13+00:00| seen| https://t.me/cvedetector/11851 2025-04-09 03:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-226/...

CVE-2024-53259

quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IPPMTUDISCDO, the kernel would then return a "message too large" error on sendmsg, i.e. when quic-go attempts to send a packet that exceed...

CVE-2024-53117

In the Linux kernel, the following vulnerability has been resolved: virtio/vsock: Improve MSGZEROCOPY error handling Add a missing kfreeskb to prevent memory leaks...

CVE-2024-53122

In the Linux kernel, the following vulnerability has been resolved: mptcp: cope racing subflow creation in mptcprcvspaceadjust Additional active subflows - i.e. created by the in kernel path manager - are included into the subflow list before starting the 3whs. A racing recvmsg spooling data...

CVE-2024-36619

FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service DoS condition...

CVE-2024-36466

A bug in the code allows an attacker to sign a forged zbxsession cookie, which then allows them to sign in with admin permissions...

CVE-2024-36464

When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. The user would need to have permissions to access the media types and therefore would be expected to have access to these passwords...

CVE-2023-1521

On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LDPRELOAD. If the server is run as root which is the default when installing the snap package https://snapcraft.io/sccache , this means a user...

Fedora 41 : cobbler (2024-4f04edd1e7)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-4f04edd1e7 advisory. Update to 3.3.7 - CVE-2024-47533 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

CVE-2024-53100

In the Linux kernel, the following vulnerability has been resolved: nvme: tcp: avoid race between queuelock lock and destroy Commit 76d54bf20cdc "nvme-tcp: don't access released socket during error recovery" added a mutexlock call for the queue-queuelock in nvmetcpgetaddress. However, the mutexlo...

opentofu-1.8.6-1.1 on GA media (moderate)

opentofu-1.8.6-1.1 on GA media Announcement ID: openSUSE-SU-2024:14520-1 Rating: moderate Cross-References: CVE-2024-34156 CVSS scores: CVE-2024-34156 SUSE : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be...

CVE-2024-53901

The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim method is called on a crafted input image...

CVE-2024-11477

7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary dependi...

Fedora 40 : microcode_ctl (2024-d20a106350)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-d20a106350 advisory. - Update to upstream 2.1-47. 20241112 - Update of 06-8f-04/0x87 SPR-SP E0/S1 microcode in intel-ucode/06-8f-05 from revision 0x2b0005c0 up to...

CVE-2024-53426

A heap-buffer-overflow vulnerability has been identified in ntopng 6.2 in the Flow::dissectMDNS function...

BELL-CVE-2024-50285

Bulletin has no description...

CVE-2024-45689

A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not have permission to access...

CVE-2024-53076

In the Linux kernel, the following vulnerability has been resolved: iio: gts-helper: Fix memory leaks for the error path of iiogtsbuildavailscaletable If pertimescalesi or pertimegainsi kcalloc fails in the for loop of iiogtsbuildavailscaletable, the errfreeout will fail to call kfree each time...