Fedora 41 : linux-firmware (2024-516b214c25)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-516b214c25 advisory. Update to upstream 20241210 Update firmware file for Intel BlazarU core amdgpu: numerous firmware updates upstream amdnpu firmware QCA: Add Bluetooth nvm fil...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : ucode-intel (SUSE-SU-2024:4053-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4053-1 advisory. - Intel CPU Microcode was updated to the 20241112 release bsc1233313 - CVE-2024-21853: Faulty...

CVE-2024-50208 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-50208 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-50045 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-50045 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-50059 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-50059 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-50198 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-50198 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

SUSE SLES12 Security Update : docker-stable (SUSE-SU-2024:4205-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2024:4205-1 advisory. - Remove DOCKERNETWORKOPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some...

PT-2024-36085 · Unknown · Joni Halabi Block Controller

Name of the Vulnerable Software and Affected Versions: Joni Halabi Block Controller versions 1.4.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

ansible-core-2.17-2.17.7-1.1 on GA media (moderate)

ansible-core-2.17-2.17.7-1.1 on GA media Announcement ID: openSUSE-SU-2024:14547-1 Rating: moderate Cross-References: CVE-2024-11079 CVSS scores: CVE-2024-11079 SUSE : 5.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L CVE-2024-11079 SUSE : 2...

CVE-2024-53137

In the Linux kernel, the following vulnerability has been resolved: ARM: fix cacheflush with PAN It seems that the cacheflush syscall got broken when PAN for LPAE was implemented. User access was not enabled around the cache maintenance instructions, causing them to fault...

CVE-2024-49419

creationtimestamp| type| source ---|---|--- 2024-12-03 06:25:41+00:00| seen| https://infosec.exchange/users/cve/statuses/113587463163015231 2024-12-03 08:08:13+00:00| seen| https://t.me/cvedetector/11851 2025-04-09 03:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-226/...

CVE-2024-53259

quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IPPMTUDISCDO, the kernel would then return a "message too large" error on sendmsg, i.e. when quic-go attempts to send a packet that exceed...

CVE-2024-53122

In the Linux kernel, the following vulnerability has been resolved: mptcp: cope racing subflow creation in mptcprcvspaceadjust Additional active subflows - i.e. created by the in kernel path manager - are included into the subflow list before starting the 3whs. A racing recvmsg spooling data...

CVE-2024-53117

In the Linux kernel, the following vulnerability has been resolved: virtio/vsock: Improve MSGZEROCOPY error handling Add a missing kfreeskb to prevent memory leaks...

CVE-2024-36619

FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service DoS condition...

CVE-2024-36466

A bug in the code allows an attacker to sign a forged zbxsession cookie, which then allows them to sign in with admin permissions...

CVE-2024-36464

When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. The user would need to have permissions to access the media types and therefore would be expected to have access to these passwords...

CVE-2023-1521

On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LDPRELOAD. If the server is run as root which is the default when installing the snap package https://snapcraft.io/sccache , this means a user...

Fedora 41 : cobbler (2024-4f04edd1e7)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-4f04edd1e7 advisory. Update to 3.3.7 - CVE-2024-47533 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

CVE-2024-53100

In the Linux kernel, the following vulnerability has been resolved: nvme: tcp: avoid race between queuelock lock and destroy Commit 76d54bf20cdc "nvme-tcp: don't access released socket during error recovery" added a mutexlock call for the queue-queuelock in nvmetcpgetaddress. However, the mutexlo...