CVE-2024-3094-analysis

CVE-2024-3094 – Real-World Supply Chain Threat What is CVE-2024-3094? CVE-2024-3094 is a major backdoor vulnerability discovered in the xz compression library. It allows attackers to potentially execute code remotely through SSH. The vulnerability was introduced intentionally and affects critical...

CVE-2024-3094

CVE-2024-3094 CVE-2024-3094 exposed a backdoor in the XZ compression library, allowing remote SSH access by bypassing authentication. It’s a major supply chain attack affecting Linux systems, highlighting risks in trusted open-source components. The XZ Backdoor: A Supply‑Chain Threat that Reaches...

CVE-2020-22916

An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file. NOTE: the vendor disputes the claims of "endless output" and "denial of service" because decompression of the 17,486 bytes always results in 114,881,179 bytes, which is often a...

OPENSUSE-SU-2021:1544-1 Security update for aaa_base

This update for aaabase fixes the following issues: - Allowed ping and ICMP commands without CAPNETRAW bsc1174504. - Add $HOME/.local/bin to PATH, if it exists bsc1192248. - Fixed getkernelversion.c to work also for recent kernels on the s390/X platform bsc1191563. - Support xz compressed kernel...

OPENSUSE-SU-2021:3899-1 Security update for aaa_base

This update for aaabase fixes the following issues: - Allowed ping and ICMP commands without CAPNETRAW bsc1174504. - Add $HOME/.local/bin to PATH, if it exists bsc1192248. - Fixed getkernelversion.c to work also for recent kernels on the s390/X platform bsc1191563. - Support xz compressed kernel...

CVE-2021-29482 denial of service in github.com/ulikunitz/xz

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size o...

OracleVM 3.2 : rpm (OVMSA-2016-0077)

The remote OracleVM system is missing necessary patches to address critical security updates : - Add missing files in /usr/share/doc/ - Fix warning when applying the patch for 1163057 - Fix race condidition where unchecked data is exposed in the file system CVE-2013-64351163057 - Fix segfault on...

FreeBSD : libxml2 -- multiple vulnerabilities (e5423caf-8fb8-11e5-918c-bcaec565249c)

reports : CVE-2015-5312 Another entity expansion issue David Drysdale. CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey David Drysdale. CVE-2015-7498 Avoid processing entities after encoding conversion failures Daniel Veillard. CVE-2015-7499 1 Add xmlHaltParser to stop the...

SUSE SLED11 / SLES11 Security Update : clamav (SUSE-SU-2014:0414-1)

The antivirus scanner ClamAV has been updated to version 0.98.1, which includes the following fixes : - Code quality fixes in libclamav, clamd, sigtool, clamav-milter, clamconf, and clamdtop. - Code quality fixes in libclamav, libclamunrar and freshclam. - bb 8385: a PDF ASCII85Decode zero-length...