GSD-2023-1001192 xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource()

xen/privcmd: Fix a possible warning in privcmdioctlmmapresource This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit...

GSD-2023-1001109 scsi: scsi_debug: Fix a warning in resp_write_scat()

scsi: scsidebug: Fix a warning in respwritescat This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit...

GSD-2023-1001097 scsi: ipr: Fix WARNING in ipr_init()

scsi: ipr: Fix WARNING in iprinit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit e59da172059f05c594fda03a9e8a3a0e1f5116c0, i...

GSD-2023-1000908 ext4: silence the warning when evicting inode with dioread_nolock

ext4: silence the warning when evicting inode with dioreadnolock This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.87 by commit...

GSD-2023-1000819 xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource()

xen/privcmd: Fix a possible warning in privcmdioctlmmapresource This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.16 by commit...

GSD-2023-1000614 rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state()

rcu: Fix thiscpuread lockdep warning in rcuforcequiescentstate This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.16 by commit...

GSD-2023-1000526 media: dvbdev: fix build warning due to comments

media: dvbdev: fix build warning due to comments This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.16 by commit...

GSD-2023-1000387 drm/amdkfd: Fix kernel warning during topology setup

drm/amdkfd: Fix kernel warning during topology setup This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.19 by commit...

GSD-2023-1000215 netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark

netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.159 by comm...

GSD-2023-1000137 netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark

netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.83 by commi...

GSD-2023-1000033 netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark

netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.13 by commit...

CVE-2021-26319

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none...

MAL-2023-163 Malicious code in cathode-versions-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0e16e7e4327697f795d989d71781e02f4036cfffca1d0dce1e5b9a6f0a54f7d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-33764 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.16 Description: The issue is related to a WARNING in the ipr init function. The actual impact and attack plausibility have not yet been proven. It was introduced in version v2.6.34 and fixed in Linux Kernel...

PT-2023-33777 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.16 Description: The issue is related to a warning in the resp write scat function. The actual impact and attack plausibility have not yet been proven. It was introduced in version v4.16 and fixed in Linux...

PT-2023-33374 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.226 Description: The issue provides a little extra FRAME WARN leeway when KASAN is enabled. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions pri...

Cacti Servers Under Attack as Majority Fail to Patch Critical Vulnerability

A majority of internet-exposed Cacti servers have not been patched against a recently patched critical security vulnerability that has come under active exploitation in the wild. That's according to attack surface management platform Censys, which found only 26 out of a total of 6,427 servers to ...

client and idm:DL1 bug fix and enhancement update

An update is available for ipa, python-jwcrypto, custodia, bind-dyndb-ldap, python-qrcode, softhsm, slapi-nis, python-yubico, python-kdcproxy, opendnssec, ipa-healthcheck, pyusb. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

gatsby-transformer-remark has possible unsanitized JavaScript code injection

Impact The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the gray-matter npm package, which is vulnerable to JavaScript injection in its default configuration, unless input is sanitized. The vulnerability is present in gatsby-transformer-remark when...

A week in security (January 1 - 8)

Last week on Malwarebytes Labs: Why does technology no longer excite us? Lock and Code S04E01 New device? Here's how to safely dispose of your old one LastPass updates security notice with information about a recent incident Okta breached last month, no customers compromised Update VPN Plus Serve...