SUSE-SU-2023:0122-1 Security update for samba

This update for samba fixes the following issues: - CVE-2021-20251: Fixed an issue where the bad password count would not be properly incremented, which could allow attackers to brute force a user's password bsc1206546. - CVE-2022-38023: Disabled weak ciphers by default in the Netlogon Secure...

PT-2023-15595 · Lenovo · Lenovo Safecenter

Name of the Vulnerable Software and Affected Versions: Lenovo Safecenter affected versions not specified Description: A denial-of-service issue has been identified that could allow a local user to crash the application. Recommendations: At the moment, there is no information about a newer version...

PT-2023-35503 · Tor · Tor

Name of the Vulnerable Software and Affected Versions: tor versions 0.4.7.12 through 0.4.7.13 Description: The issue concerns a fix for the SafeSocks option to avoid DNS leaks. Additionally, there are improvements to congestion control and a fix for relay channel handling. New metrics are also...

Vulnerability fixed in Cisco Unified Communications Manager

Cisco has fixed an SQL injection vulnerability in Unified Communications Manager and Unified Communications Manager Session Management Edition SME. An authenticated malicious person with access to the management interface, could exploit the vulnerability to perform SQL injections and thereby gain...

Security Bulletin: IBM Cloud Pak for Security (CP4S) is vulnerable to information disclosure (CVE-2021-39090)

Summary IBM Cloud Pak for Security CP4S could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. This has been updated in the latest release and the vulnerability has been addressed. Please follow the instructions in t...

PT-2023-13403 · Dell · Idrac8

Name of the Vulnerable Software and Affected Versions: Dell iDRAC8 versions 2.83.83.83 and prior Description: The issue is related to an improper input validation in Racadm when the firmware lock-down configuration is set, allowing a remote high privileged attacker to bypass this configuration an...

GSD-2023-1001632 mtd: lpddr2_nvm: Fix possible null-ptr-deref

mtd: lpddr2nvm: Fix possible null-ptr-deref This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.337 by commit...

GSD-2023-1000850 pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP

pstore: Avoid kcore oops by vmaping with VMIOREMAP This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.16 by commit...

GSD-2023-1000412 net/mlx5: Lag, fix failure to cancel delayed bond work

net/mlx5: Lag, fix failure to cancel delayed bond work This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.19 by commit...

GSD-2023-1000375 iio: health: afe4403: Fix oob read in afe4403_read_raw

iio: health: afe4403: Fix oob read in afe4403readraw This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.301 by commit...

PT-2023-33863 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.16 Description: The issue concerns a device name leak that occurs when registering a device fails in the add mtd device function. This problem was introduced in version v2.6.30 and is fixed in Linux Kernel...

PT-2023-33528 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.19 through v6.0.17 Description: A memory leak issue was discovered in the kexec functionality of the RISC-V architecture in the Linux Kernel. The issue was introduced in version v5.19 and fixed in version v6.0.18. The...

PT-2023-33110 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v6.0.11 through v6.0.12 Description: The issue is related to a data race in the netfilter ctnetlink component. It was introduced in version v6.0.11 and fixed in version v6.0.13. The actual impact and attack plausibility...

PT-2023-34159 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.86 Description: A memory leak issue was discovered in the test firmware init function. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v4.14 and is...

SUSE: Security Advisory (SUSE-SU-2023:0088-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[slackware-security] netatalk

New netatalk packages are available for Slackware 14.1, 14.2, 15.0, and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/netatalk-3.1.14-i586-1slack15.0.txz: Upgraded. Netatalk through 3.1.13 has an afpgetappl heap-based buffer overflow...

PT-2023-14085 · Nvidia · Nvidia Bmc

Name of the Vulnerable Software and Affected Versions: NVIDIA BMC affected versions not specified Description: The issue concerns the storage of user passwords in an obfuscated form within a database that is accessible by the host, potentially leading to credentials exposure. Recommendations: At...

PT-2023-14084 · Nvidia · Nvidia Bmc

Name of the Vulnerable Software and Affected Versions: NVIDIA BMC affected versions not specified Description: The issue is related to a buffer overflow in the IPMI handler of NVIDIA BMC. An authorized attacker can exploit this to cause a denial of service or potentially gain code execution...

Security Bulletin: ICP Speech to Text, Text to Speech Oracle Java Vulnerability Fix

Summary An Oracle Java vulnerability has been fixed by a Redhat patch https://access.redhat.com/errata/RHSA-2020:0202, included in ICP Watson Text to Speech, Speech to Text v1.1.2 6/19/20. Vulnerability Details CVEID:CVE-2020-2654 DESCRIPTION: An unspecified vulnerability in Java SE related to th...

Security Bulletin: Speech to Text, Text to Speech ICP, WebSphere Application Server Liberty Fix

Summary A vulnerability in Apache CXF affecting WebSphere Liberty JAX-WS has been fixed in Liberty: 20.0.0.5. This fix is included in ICP Watson Text to Speech, Speech to Text v1.1.2 GA: 6/19/20. Vulnerability Details CVEID:CVE-2019-17573 DESCRIPTION: Apache CXF is vulnerable to cross-site...