14 hours 58 minutes ago
It was discovered that Tomcat incorrectly handled being configured with
HTTP PUTs enabled. A remote attacker could use this issue to upload a JSP
file to the server and execute arbitrary code. This issue only affected
Ubuntu 16.04 LTS. (CVE-2017-12616, CVE-2017-12617)
15 hours 4 minutes ago
It was discovered that the Apache Solr DataImportHandler module incorrectly
handled certain request parameters in a default configuration. A remote
attacker could possibly use this issue to execute arbitrary code.
20 hours 24 minutes ago
USN-7275-1 fixed vulnerabilities in Libtasn1. This update provides the
corresponding updates for Ubuntu 24.04 LTS.
Original advisory details:
Bing Shi discovered that Libtasn1 inefficiently handled certificates. An
attacker could possibly use this issue to increase resource utilization
leading to a denial of service.
21 hours 17 minutes ago
Bing Shi discovered that GnuTLS incorrectly handled decoding certain
DER-encoded certificates. A remote attacker could possibly use this issue
to cause GnuTLS to consume resources, leading to a denial of service.
21 hours 24 minutes ago
It was discovered that Python incorrectly handled parsing domain names that
included square brackets. A remote attacker could possibly use this issue
to perform a Server-Side Request Forgery (SSRF) attack.
21 hours 32 minutes ago
Several security issues were discovered in the WebKitGTK Web and JavaScript
engines. If a user were tricked into viewing a malicious website, a remote
attacker could exploit a variety of issues related to web browser security,
including cross-site scripting attacks, denial of service attacks, and
arbitrary code execution.
21 hours 38 minutes ago
George Pantelakis and Alicja Kario discovered that OpenSSL had a timing
side-channel when performing ECDSA signature computations. A remote
attacker could possibly use this issue to recover private data.
(CVE-2024-13176)
It was discovered that OpenSSL incorrectly handled certain memory
operations when using low-level GF(2^m) elliptic curve APIs with untrusted
explicit values for the field polynomial. When being used in this uncommon
fashion, a remote attacker could use this issue to cause OpenSSL to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2024-9143)
1 day 5 hours ago
In the Linux kernel, the following vulnerability has been
resolved: tls: fix use-after-free on failed backlog decryption When the
decrypt request goes to the backlog and crypto_aead_decrypt returns -EBUSY,
tls_do_decryption will wait until all async decryptions have completed. If
one of them fails, tls_do_decryption will return -EBADMSG and
tls_decrypt_sg jumps to the error path, releasing all the pages. But the
pages have been passed to the async callback, and have already been
released by tls_decrypt_done. The only true async case is when
crypto_aead_decrypt returns -EINPROGRESS. With -EBUSY, we already waited so
we can tell tls_sw_recvmsg that the data is available for immediate copy,
but we need to notify tls_decrypt_sg (via the new ->async_done flag) that
the memory has already been released.)(CVE-2024-26800)
In the Linux kernel, the following vulnerability has been
resolved: inet: inet_defrag: prevent sk release while still in use
ip_local_out() and other functions can pass skb->sk as function argument.
If the skb is a fragment and reassembly happens before such function call
returns, the sk must not be released. This affects skb fragments
reassembled via netfilter or similar modules, e.g. openvswitch or ct_act.c,
when run as part of tx pipeline. Eric Dumazet made an initial analysis of
this bug. Quoting Eric: Calling ip_defrag() in output path is also implying
skb_orphan(), which is buggy because output path relies on sk not
disappearing. A relevant old patch about the issue was : 8282f27449bf
('inet: frag: Always orphan skbs inside ip_defrag()') [..
net/ipv4/ip_output.c depends on skb->sk being set, and probably to an inet
socket, not an arbitrary one. If we orphan the packet in ipvlan, then
downstream things like FQ packet scheduler will not work properly. We need
to change ip_defrag() to only use skb_orphan() when really needed, ie
whenever frag_list is going to be used. Eric suggested to stash sk in
fragment queue and made an initial patch. However there is a problem with
this: If skb is refragmented again right after, ip_do_fragment() will copy
head->sk to the new fragments, and sets up destructor to sock_wfree. IOW,
we have no choice but to fix up sk_wmem accouting to reflect the fully
reassembled skb, else wmem will underflow. This change moves the orphan
down into the core, to last possible moment. As ip_defrag_offset is aliased
with sk_buff->sk member, we must move the offset into the FRAG_CB, else
skb->sk gets clobbered. This allows to delay the orphaning long enough to
learn if the skb has to be queued or if the skb is completing the reasm
queue. In the former case, things work as before, skb is orphaned. This is
safe because skb gets queued/stolen and won't continue past reasm engine.
In the latter case, we will steal the skb->sk reference, reattach it to the
head skb, and fix up wmem accouting when inet_frag inflates truesize.)(CVE-2024-26921)
In the Linux kernel, the following vulnerability has been
resolved: watchdog: cpu5wdt.c: Fix use-after-free bug caused by
cpu5wdt_trigger When the cpu5wdt module is removing, the origin code uses
del_timer() to de-activate the timer. If the timer handler is running,
del_timer() could not stop it and will return directly. If the port region
is released by release_region() and then the timer handler
cpu5wdt_trigger() calls outb() to write into the region that is released,
the use-after-free bug will happen. Change del_timer() to
timer_shutdown_sync() in order that the timer handler could be finished
before the port region is released.)(CVE-2024-38630)
In the Linux kernel, the following vulnerability has been
resolved: exec: Fix ToCToU between perm check and set-uid/gid usage When
opening a file for exec via do_filp_open(), permission checking is done
against the file's metadata at that moment, and on success, a file pointer
is passed back. Much later in the execve() code path, the file metadata
(specifically mode, uid, and gid) is used to determine if/how to set the
uid and gid. However, those values may have changed since the permissions
check, meaning the execution may gain unintended privileges. For example,
if a file could change permissions from executable and not set-id:
---------x 1 root root 16048 Aug 7 13:16 target to set-id and non-
executable: ---S------ 1 root root 16048 Aug 7 13:16 target it is possible
to gain root privileges when execution should have been disallowed. While
this race condition is rare in real-world scenarios, it has been observed
(and proven exploitable) when package managers are updating the setuid bits
of installed programs. Such files start with being world-executable but
then are adjusted to be group-exec with a set-uid bit. For example, 'chmod
o-x,u+s target' makes 'target' executable only by uid 'root' and gid
'cdrom', while also becoming setuid-root: -rwxr-xr-x 1 root cdrom 16048 Aug
7 13:16 target becomes: -rwsr-xr-- 1 root cdrom 16048 Aug 7 13:16 target
But racing the chmod means users without group 'cdrom' membership can get
the permission to execute 'target' just before the chmod, and when the
chmod finishes, the exec reaches brpm_fill_uid(), and performs the setuid
to root, violating the expressed authorization of 'only cdrom group members
can setuid to root'. Re-check that we still have execute permissions in
case the metadata has changed. It would be better to keep a copy from the
perm-check time, but until we can do that refactoring, the least-bad option
is to do a full inode_permission() call (under inode lock). It is
understood that this is safe against dead-locks, but hardly optimal.)(CVE-2024-43882)
In the Linux kernel, the following vulnerability has been
resolved: vsock/virtio: Initialization of the dangling pointer occurring in
vsk->trans During loopback communication, a dangling pointer can be created
in vsk->trans, potentially leading to a Use-After-Free condition. This
issue is resolved by initializing vsk->trans to NULL.)(CVE-2024-50264)
In the Linux kernel, the following vulnerability has been
resolved: hv_sock: Initializing vsk->trans to NULL to prevent a dangling
pointer When hvs is released, there is a possibility that vsk->trans may
not be initialized to NULL, which could lead to a dangling pointer. This
issue is resolved by initializing vsk->trans to NULL.)(CVE-2024-53103)
1 day 22 hours ago
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- SuperH RISC architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- ATA over ethernet (AOE) driver;
- RAM backed block device driver;
- Network block device driver;
- Ublk userspace block driver;
- Compressed RAM block device driver;
- Bluetooth drivers;
- TPM device driver;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- CPU frequency scaling framework;
- Hardware crypto device drivers;
- CXL (Compute Express Link) drivers;
- DAX dirext access to differentiated memory framework;
- Buffer Sharing and Synchronization framework;
- EDAC drivers;
- FireWire subsystem;
- ARM SCMI message protocol;
- ARM SCPI message protocol;
- EFI core;
- Qualcomm firmware drivers;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- I2C subsystem;
- I3C subsystem;
- IIO ADC drivers;
- IIO subsystem;
- InfiniBand drivers;
- Input Device core drivers;
- IOMMU subsystem;
- IRQ chip drivers;
- Mailbox framework;
- Multiple devices driver;
- Media drivers;
- Multifunction device drivers;
- MMC subsystem;
- MTD block device drivers;
- Ethernet bonding driver;
- Network drivers;
- Mellanox network drivers;
- STMicroelectronics network drivers;
- NTB driver;
- Virtio pmem driver;
- NVME drivers;
- Parport drivers;
- PCI subsystem;
- Alibaba DDR Sub-System Driveway PMU driver;
- PHY drivers;
- Pin controllers subsystem;
- x86 platform drivers;
- i.MX PM domains;
- Powercap sysfs driver;
- Voltage and Current Regulator drivers;
- Remote Processor subsystem;
- StarFive reset controller drivers;
- Real Time Clock drivers;
- SCSI subsystem;
- SuperH / SH-Mobile drivers;
- QCOM SoC drivers;
- Xilinx SoC drivers;
- SPI subsystem;
- Direct Digital Synthesis drivers;
- Media staging drivers;
- TCM subsystem;
- Thermal drivers;
- Thunderbolt and USB4 drivers;
- TTY drivers;
- UFS subsystem;
- USB Device Class drivers;
- DesignWare USB3 driver;
- USB Gadget drivers;
- USB Host Controller drivers;
- USB Dual Role (OTG-ready) Controller drivers;
- USB Serial drivers;
- USB Type-C support driver;
- USB Type-C Port Controller Manager driver;
- TI TPS6598x USB Power Delivery controller driver;
- USB Type-C Connector System Software Interface driver;
- vDPA drivers;
- VFIO drivers;
- Virtio Host (VHOST) subsystem;
- Framebuffer layer;
- Virtio drivers;
- Xen hypervisor drivers;
- AFS file system;
- BTRFS file system;
- File systems infrastructure;
- Ceph distributed file system;
- EROFS file system;
- Ext4 file system;
- F2FS file system;
- GFS2 file system;
- JFS file system;
- Network file systems library;
- Network file system (NFS) client;
- Network file system (NFS) server daemon;
- NILFS2 file system;
- File system notification infrastructure;
- NTFS3 file system;
- Proc file system;
- SMB network file system;
- UBI file system;
- BPF subsystem;
- Network file system (NFS) superblock;
- Virtio network driver;
- Bluetooth subsystem;
- Network traffic control;
- Network sockets;
- TCP network protocol;
- Tracing infrastructure;
- User-space API (UAPI);
- Kernel init infrastructure;
- io_uring subsystem;
- IPC subsystem;
- Perf events;
- Kernel fork() syscall;
- Kernel thread helper (kthread);
- Padata parallel execution mechanism;
- RCU subsystem;
- Arbitrary resource management;
- Scheduler infrastructure;
- Signal handling mechanism;
- Static call mechanism;
- Task handling mechanism;
- Timer substystem drivers;
- Maple Tree data structure library;
- Memory management;
- 9P file system network protocol;
- Ethernet bridge;
- CAN network layer;
- Networking core;
- DCCP (Datagram Congestion Control Protocol);
- Distributed Switch Architecture;
- IPv4 networking;
- IPv6 networking;
- IUCV driver;
- L2TP protocol;
- MAC80211 subsystem;
- IEEE 802.15.4 subsystem;
- Multipath TCP;
- NCSI (Network Controller Sideband Interface) driver;
- Netfilter;
- Netlink;
- RxRPC session sockets;
- SCTP protocol;
- SMC sockets;
- Sun RPC protocol;
- TIPC protocol;
- Unix domain sockets;
- VMware vSockets driver;
- Wireless networking;
- eXpress Data Path;
- XFRM subsystem;
- AppArmor security module;
- Integrity Measurement Architecture(IMA) framework;
- Key management;
- ALSA framework;
- FireWire sound drivers;
- AudioScience HPI driver;
- HD-audio driver;
- SoC Audio for Freescale CPUs drivers;
- Intel ASoC drivers;
- MediaTek ASoC drivers;
- QCOM ASoC drivers;
- SoC audio core drivers;
- STMicroelectronics SoC drivers;
- USB sound devices;
- KVM core;
(CVE-2024-50030, CVE-2024-47689, CVE-2024-50088, CVE-2024-50154,
CVE-2024-49994, CVE-2024-50243, CVE-2024-50284, CVE-2024-50207,
CVE-2024-53200, CVE-2024-53155, CVE-2024-50179, CVE-2024-50171,
CVE-2024-53167, CVE-2024-49885, CVE-2024-49869, CVE-2024-49934,
CVE-2024-53089, CVE-2024-50196, CVE-2024-53090, CVE-2024-47675,
CVE-2024-47690, CVE-2024-56674, CVE-2024-50082, CVE-2024-47742,
CVE-2024-53220, CVE-2024-50172, CVE-2024-50009, CVE-2024-49881,
CVE-2024-50249, CVE-2024-47752, CVE-2024-56707, CVE-2024-53105,
CVE-2024-53048, CVE-2024-50148, CVE-2024-50036, CVE-2024-53141,
CVE-2024-50213, CVE-2024-49911, CVE-2024-50285, CVE-2024-56535,
CVE-2024-49882, CVE-2024-50225, CVE-2024-50090, CVE-2024-53063,
CVE-2024-56703, CVE-2024-47687, CVE-2024-53079, CVE-2024-47744,
CVE-2024-50020, CVE-2024-53078, CVE-2024-53176, CVE-2024-53183,
CVE-2024-50248, CVE-2024-50283, CVE-2024-49907, CVE-2024-50084,
CVE-2024-56541, CVE-2024-49979, CVE-2024-53175, CVE-2024-49871,
CVE-2024-47678, CVE-2024-47720, CVE-2024-53059, CVE-2024-56685,
CVE-2024-56702, CVE-2024-50071, CVE-2024-56534, CVE-2024-56745,
CVE-2024-53154, CVE-2024-47736, CVE-2024-49965, CVE-2024-47701,
CVE-2024-50159, CVE-2024-50040, CVE-2024-50274, CVE-2024-49876,
CVE-2024-49895, CVE-2024-50189, CVE-2024-56704, CVE-2024-47681,
CVE-2024-53106, CVE-2024-56744, CVE-2024-53197, CVE-2024-50120,
CVE-2024-50204, CVE-2024-50184, CVE-2024-53095, CVE-2024-50101,
CVE-2024-53146, CVE-2024-50256, CVE-2024-53226, CVE-2024-47712,
CVE-2024-50137, CVE-2024-53131, CVE-2024-49888, CVE-2024-50235,
CVE-2024-50047, CVE-2024-50224, CVE-2024-50142, CVE-2024-50200,
CVE-2024-53085, CVE-2024-49892, CVE-2024-50263, CVE-2024-53150,
CVE-2024-53121, CVE-2024-49977, CVE-2024-50144, CVE-2024-50127,
CVE-2024-53092, CVE-2024-50265, CVE-2024-56691, CVE-2024-53069,
CVE-2024-49902, CVE-2024-47715, CVE-2024-56720, CVE-2024-53127,
CVE-2024-53142, CVE-2024-49862, CVE-2024-49918, CVE-2024-56684,
CVE-2024-50208, CVE-2024-53189, CVE-2024-50103, CVE-2024-56756,
CVE-2024-50273, CVE-2024-56536, CVE-2024-53068, CVE-2024-49878,
CVE-2024-47705, CVE-2024-53113, CVE-2024-50129, CVE-2024-49942,
CVE-2024-50100, CVE-2024-49930, CVE-2024-50043, CVE-2024-53198,
CVE-2024-49861, CVE-2024-50124, CVE-2024-50209, CVE-2024-53187,
CVE-2024-49864, CVE-2024-56689, CVE-2024-50294, CVE-2024-47706,
CVE-2024-50186, CVE-2024-53086, CVE-2024-49954, CVE-2024-56692,
CVE-2024-47679, CVE-2024-53109, CVE-2024-50001, CVE-2024-49983,
CVE-2024-56679, CVE-2024-50034, CVE-2024-50276, CVE-2024-56680,
CVE-2024-49988, CVE-2024-53099, CVE-2024-50021, CVE-2024-50022,
CVE-2024-50136, CVE-2024-53193, CVE-2024-50220, CVE-2024-49858,
CVE-2024-50229, CVE-2024-50074, CVE-2024-50002, CVE-2024-53117,
CVE-2024-50176, CVE-2024-50075, CVE-2024-50045, CVE-2024-49924,
CVE-2024-47686, CVE-2024-50104, CVE-2024-47714, CVE-2024-50291,
CVE-2024-49929, CVE-2024-53215, CVE-2024-50157, CVE-2024-50147,
CVE-2024-49898, CVE-2024-50164, CVE-2024-47711, CVE-2024-53082,
CVE-2024-50230, CVE-2024-50152, CVE-2024-53218, CVE-2024-53199,
CVE-2024-50253, CVE-2024-47754, CVE-2024-49910, CVE-2024-53137,
CVE-2024-50128, CVE-2024-50044, CVE-2024-47719, CVE-2024-53188,
CVE-2024-53061, CVE-2024-49944, CVE-2024-50091, CVE-2024-49945,
CVE-2024-50119, CVE-2024-50133, CVE-2024-50033, CVE-2024-53083,
CVE-2024-50138, CVE-2024-49872, CVE-2024-50140, CVE-2024-56727,
CVE-2024-50003, CVE-2024-50015, CVE-2024-50303, CVE-2024-50258,
CVE-2024-49867, CVE-2024-50116, CVE-2024-47716, CVE-2024-50132,
CVE-2024-50055, CVE-2024-49950, CVE-2024-50203, CVE-2024-47695,
CVE-2024-50250, CVE-2024-50165, CVE-2024-50156, CVE-2024-56700,
CVE-2024-49913, CVE-2024-50281, CVE-2024-53045, CVE-2024-49998,
CVE-2024-53180, CVE-2024-50271, CVE-2024-50286, CVE-2024-49887,
CVE-2024-53168, CVE-2024-47676, CVE-2024-47726, CVE-2024-47732,
CVE-2024-47704, CVE-2024-49980, CVE-2024-49931, CVE-2024-53229,
CVE-2024-50141, CVE-2024-50282, CVE-2024-50233, CVE-2024-56725,
CVE-2024-50239, CVE-2024-50299, CVE-2024-50218, CVE-2024-53072,
CVE-2024-49903, CVE-2024-50163, CVE-2024-53100, CVE-2024-50146,
CVE-2024-49859, CVE-2024-50227, CVE-2024-50188, CVE-2024-56739,
CVE-2024-53217, CVE-2024-53118, CVE-2024-49946, CVE-2024-53212,
CVE-2024-49926, CVE-2024-53177, CVE-2024-56741, CVE-2024-53234,
CVE-2024-49932, CVE-2024-50095, CVE-2024-50190, CVE-2024-49995,
CVE-2024-49976, CVE-2024-49906, CVE-2024-49996, CVE-2024-53049,
CVE-2024-47751, CVE-2024-56677, CVE-2024-56724, CVE-2024-47746,
CVE-2024-50245, CVE-2024-53236, CVE-2024-53191, CVE-2024-50112,
CVE-2024-49937, CVE-2024-50234, CVE-2024-50067, CVE-2024-53112,
CVE-2024-50017, CVE-2024-50008, CVE-2024-50194, CVE-2024-50076,
CVE-2024-47697, CVE-2024-56693, CVE-2024-50280, CVE-2024-50182,
CVE-2024-53237, CVE-2024-50011, CVE-2024-49912, CVE-2024-50217,
CVE-2024-56532, CVE-2024-53221, CVE-2024-50206, CVE-2024-47700,
CVE-2024-56537, CVE-2024-49959, CVE-2024-56681, CVE-2024-49936,
CVE-2024-49900, CVE-2024-53077, CVE-2024-56705, CVE-2024-53125,
CVE-2024-49968, CVE-2024-49969, CVE-2024-56545, CVE-2024-50106,
CVE-2024-53160, CVE-2024-50013, CVE-2024-49880, CVE-2024-53228,
CVE-2024-50177, CVE-2024-47684, CVE-2024-47739, CVE-2024-50029,
CVE-2024-53194, CVE-2024-50237, CVE-2024-50035, CVE-2024-49941,
CVE-2024-49947, CVE-2024-50289, CVE-2024-49949, CVE-2024-50023,
CVE-2024-50139, CVE-2024-49886, CVE-2024-50026, CVE-2024-56748,
CVE-2024-53080, CVE-2024-56754, CVE-2024-49999, CVE-2024-49963,
CVE-2024-49855, CVE-2024-50252, CVE-2024-49975, CVE-2024-50107,
CVE-2024-56749, CVE-2024-49928, CVE-2024-49865, CVE-2024-50125,
CVE-2024-49899, CVE-2024-47750, CVE-2024-53152, CVE-2024-50081,
CVE-2024-49891, CVE-2024-49927, CVE-2024-49852, CVE-2024-50085,
CVE-2024-50185, CVE-2024-50205, CVE-2024-49896, CVE-2024-50278,
CVE-2024-49866, CVE-2024-53190, CVE-2024-50251, CVE-2024-50269,
CVE-2024-49889, CVE-2024-50037, CVE-2024-53144, CVE-2024-53138,
CVE-2024-50087, CVE-2024-56678, CVE-2024-53087, CVE-2024-50180,
CVE-2024-49940, CVE-2024-50019, CVE-2024-53149, CVE-2024-50122,
CVE-2024-50038, CVE-2024-53156, CVE-2024-49943, CVE-2024-50113,
CVE-2024-47721, CVE-2024-53076, CVE-2024-50115, CVE-2024-50178,
CVE-2024-50268, CVE-2024-50279, CVE-2024-53134, CVE-2024-50199,
CVE-2024-49989, CVE-2024-47671, CVE-2024-49909, CVE-2024-53173,
CVE-2024-53053, CVE-2024-53088, CVE-2024-50078, CVE-2024-50105,
CVE-2024-50223, CVE-2024-50126, CVE-2024-47680, CVE-2024-47724,
CVE-2024-53047, CVE-2024-50060, CVE-2024-53056, CVE-2024-49987,
CVE-2024-49879, CVE-2024-53128, CVE-2024-53123, CVE-2024-49981,
CVE-2024-50277, CVE-2024-50166, CVE-2024-53067, CVE-2024-49964,
CVE-2024-56728, CVE-2024-49853, CVE-2024-53064, CVE-2024-56531,
CVE-2024-53213, CVE-2024-50246, CVE-2024-50192, CVE-2024-53184,
CVE-2024-56697, CVE-2024-47710, CVE-2024-53052, CVE-2024-47718,
CVE-2024-49938, CVE-2024-49893, CVE-2024-53133, CVE-2024-50096,
CVE-2024-53129, CVE-2024-49951, CVE-2024-53181, CVE-2024-50059,
CVE-2024-50193, CVE-2024-53120, CVE-2024-50114, CVE-2024-49962,
CVE-2024-49921, CVE-2024-50298, CVE-2024-50255, CVE-2024-53219,
CVE-2024-49905, CVE-2024-50211, CVE-2024-49860, CVE-2024-47727,
CVE-2024-50028, CVE-2024-47723, CVE-2024-53081, CVE-2024-56683,
CVE-2024-49897, CVE-2024-50065, CVE-2024-56708, CVE-2024-50151,
CVE-2023-52917, CVE-2024-56538, CVE-2024-47691, CVE-2024-53196,
CVE-2024-50150, CVE-2024-50069, CVE-2024-50301, CVE-2024-50131,
CVE-2024-53110, CVE-2024-56701, CVE-2024-53115, CVE-2024-53062,
CVE-2024-50058, CVE-2024-53148, CVE-2024-53147, CVE-2024-50226,
CVE-2024-56540, CVE-2024-53124, CVE-2024-50170, CVE-2024-50266,
CVE-2024-50296, CVE-2024-49953, CVE-2024-47692, CVE-2024-49916,
CVE-2024-53239, CVE-2024-50173, CVE-2024-49868, CVE-2024-47677,
CVE-2024-49972, CVE-2024-50130, CVE-2024-56698, CVE-2024-50231,
CVE-2024-50272, CVE-2024-53153, CVE-2024-50158, CVE-2024-53046,
CVE-2024-49908, CVE-2024-47709, CVE-2024-53058, CVE-2024-50006,
CVE-2024-49948, CVE-2024-47685, CVE-2024-47693, CVE-2024-50260,
CVE-2024-50079, CVE-2024-50149, CVE-2024-53151, CVE-2024-47757,
CVE-2024-49917, CVE-2024-50288, CVE-2024-50117, CVE-2024-50039,
CVE-2024-56690, CVE-2024-50293, CVE-2024-50145, CVE-2024-53166,
CVE-2024-47713, CVE-2024-53158, CVE-2024-50068, CVE-2024-53074,
CVE-2024-49914, CVE-2024-49870, CVE-2024-50031, CVE-2024-47735,
CVE-2024-50007, CVE-2024-49915, CVE-2024-47699, CVE-2024-50244,
CVE-2024-50216, CVE-2024-53114, CVE-2024-53043, CVE-2024-47688,
CVE-2024-47734, CVE-2024-53230, CVE-2024-53122, CVE-2024-50123,
CVE-2024-53116, CVE-2024-56726, CVE-2024-56747, CVE-2024-56548,
CVE-2024-50174, CVE-2024-53042, CVE-2024-53135, CVE-2024-50080,
CVE-2024-49997, CVE-2024-49974, CVE-2024-53145, CVE-2024-53075,
CVE-2024-47730, CVE-2024-50304, CVE-2024-50161, CVE-2024-49883,
CVE-2024-53111, CVE-2024-53233, CVE-2024-47698, CVE-2024-50012,
CVE-2024-50240, CVE-2024-53163, CVE-2024-53071, CVE-2024-50168,
CVE-2024-47740, CVE-2024-50275, CVE-2024-49961, CVE-2024-50183,
CVE-2024-53203, CVE-2024-47738, CVE-2024-49856, CVE-2024-50014,
CVE-2024-50191, CVE-2024-46869, CVE-2024-56721, CVE-2024-50056,
CVE-2024-53210, CVE-2024-49978, CVE-2024-53161, CVE-2024-50155,
CVE-2024-50270, CVE-2024-50169, CVE-2024-49952, CVE-2024-50236,
CVE-2024-49863, CVE-2024-49857, CVE-2024-53140, CVE-2024-53107,
CVE-2024-50247, CVE-2024-53084, CVE-2024-50077, CVE-2024-50121,
CVE-2024-53091, CVE-2024-49925, CVE-2024-47745, CVE-2024-50086,
CVE-2024-53101, CVE-2024-56729, CVE-2024-56751, CVE-2024-50016,
CVE-2024-49901, CVE-2024-47694, CVE-2024-53098, CVE-2024-53232,
CVE-2024-50108, CVE-2024-50197, CVE-2024-50242, CVE-2024-50222,
CVE-2024-53132, CVE-2024-50212, CVE-2024-49933, CVE-2024-53169,
CVE-2024-49957, CVE-2024-56533, CVE-2024-47708, CVE-2024-50267,
CVE-2024-56723, CVE-2024-50110, CVE-2024-50064, CVE-2024-56722,
CVE-2024-53130, CVE-2024-53208, CVE-2024-50102, CVE-2024-50153,
CVE-2024-49939, CVE-2024-53094, CVE-2024-50262, CVE-2024-49850,
CVE-2024-53195, CVE-2024-53170, CVE-2024-50093, CVE-2024-53223,
CVE-2024-53093, CVE-2024-56699, CVE-2024-50070, CVE-2024-49992,
CVE-2024-50111, CVE-2024-47728, CVE-2024-53202, CVE-2024-47741,
CVE-2024-49920, CVE-2024-56694, CVE-2024-53126, CVE-2024-49851,
CVE-2024-50099, CVE-2024-50302, CVE-2024-50214, CVE-2024-49973,
CVE-2024-50024, CVE-2024-50162, CVE-2024-53214, CVE-2024-50073,
CVE-2024-50061, CVE-2024-56549, CVE-2024-56688, CVE-2024-49960,
CVE-2024-56543, CVE-2024-53178, CVE-2024-50027, CVE-2024-50295,
CVE-2024-53104, CVE-2024-53065, CVE-2024-47747, CVE-2024-49991,
CVE-2024-50202, CVE-2024-49935, CVE-2024-50062, CVE-2024-50094,
CVE-2024-56544, CVE-2024-50010, CVE-2024-49971, CVE-2024-50083,
CVE-2024-56687, CVE-2024-47753, CVE-2024-50297, CVE-2024-47733,
CVE-2024-50135, CVE-2024-50066, CVE-2024-50118, CVE-2024-56746,
CVE-2024-47682, CVE-2024-53165, CVE-2024-50025, CVE-2024-49875,
CVE-2024-47717, CVE-2024-49894, CVE-2024-50198, CVE-2024-50167,
CVE-2024-49958, CVE-2024-49966, CVE-2024-50254, CVE-2024-49904,
CVE-2024-50041, CVE-2024-50005, CVE-2024-53066, CVE-2024-50000,
CVE-2024-50215, CVE-2024-47748, CVE-2024-56742, CVE-2024-50259,
CVE-2024-50092, CVE-2024-47737, CVE-2024-53238, CVE-2024-50300,
CVE-2024-53192, CVE-2024-47696, CVE-2024-50134, CVE-2024-50201,
CVE-2024-50181, CVE-2024-49873, CVE-2024-50187, CVE-2024-53171,
CVE-2024-50160, CVE-2024-49923, CVE-2024-50063, CVE-2024-53174,
CVE-2024-50143, CVE-2024-49982, CVE-2024-56546, CVE-2024-50109,
CVE-2024-53119, CVE-2024-47707, CVE-2024-56696, CVE-2024-53108,
CVE-2024-47731, CVE-2024-50261, CVE-2024-50042, CVE-2024-49884,
CVE-2024-53162, CVE-2024-56755, CVE-2024-49919, CVE-2024-53216,
CVE-2024-50287, CVE-2024-53143, CVE-2024-50257, CVE-2024-49890,
CVE-2024-53172, CVE-2024-53209, CVE-2024-49956, CVE-2024-50238,
CVE-2024-49955, CVE-2024-50046, CVE-2024-50098, CVE-2024-50232,
CVE-2024-50292, CVE-2024-56752, CVE-2024-50195, CVE-2024-47743,
CVE-2024-53044, CVE-2024-50049, CVE-2024-49986, CVE-2024-53055,
CVE-2024-56539, CVE-2024-50048, CVE-2024-49985, CVE-2024-53227,
CVE-2024-49970, CVE-2024-47702, CVE-2024-49874, CVE-2024-47703,
CVE-2024-53139, CVE-2024-50072, CVE-2024-53224, CVE-2024-49877,
CVE-2024-49922, CVE-2024-50290, CVE-2024-47756, CVE-2024-50221,
CVE-2024-50057, CVE-2022-49034, CVE-2024-53157, CVE-2024-47749,
CVE-2024-53231)
1 day 23 hours ago
Attila Szász discovered that the HFS+ file system implementation in the
Linux Kernel contained a heap overflow vulnerability. An attacker could use
a specially crafted file system image that, when mounted, could cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2025-0927)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- SuperH RISC architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- ATA over ethernet (AOE) driver;
- RAM backed block device driver;
- Network block device driver;
- Ublk userspace block driver;
- Compressed RAM block device driver;
- Bluetooth drivers;
- TPM device driver;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- CPU frequency scaling framework;
- Hardware crypto device drivers;
- CXL (Compute Express Link) drivers;
- DAX dirext access to differentiated memory framework;
- Buffer Sharing and Synchronization framework;
- EDAC drivers;
- FireWire subsystem;
- ARM SCMI message protocol;
- ARM SCPI message protocol;
- EFI core;
- Qualcomm firmware drivers;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- I2C subsystem;
- I3C subsystem;
- IIO ADC drivers;
- IIO subsystem;
- InfiniBand drivers;
- Input Device core drivers;
- IOMMU subsystem;
- IRQ chip drivers;
- Mailbox framework;
- Multiple devices driver;
- Media drivers;
- Multifunction device drivers;
- MMC subsystem;
- MTD block device drivers;
- Ethernet bonding driver;
- Network drivers;
- Mellanox network drivers;
- STMicroelectronics network drivers;
- NTB driver;
- Virtio pmem driver;
- NVME drivers;
- Parport drivers;
- PCI subsystem;
- Alibaba DDR Sub-System Driveway PMU driver;
- PHY drivers;
- Pin controllers subsystem;
- x86 platform drivers;
- i.MX PM domains;
- Powercap sysfs driver;
- Voltage and Current Regulator drivers;
- Remote Processor subsystem;
- StarFive reset controller drivers;
- Real Time Clock drivers;
- SCSI subsystem;
- SuperH / SH-Mobile drivers;
- QCOM SoC drivers;
- Xilinx SoC drivers;
- SPI subsystem;
- Direct Digital Synthesis drivers;
- Media staging drivers;
- TCM subsystem;
- Thermal drivers;
- Thunderbolt and USB4 drivers;
- TTY drivers;
- UFS subsystem;
- USB Device Class drivers;
- DesignWare USB3 driver;
- USB Gadget drivers;
- USB Host Controller drivers;
- USB Dual Role (OTG-ready) Controller drivers;
- USB Serial drivers;
- USB Type-C support driver;
- USB Type-C Port Controller Manager driver;
- TI TPS6598x USB Power Delivery controller driver;
- USB Type-C Connector System Software Interface driver;
- vDPA drivers;
- VFIO drivers;
- Virtio Host (VHOST) subsystem;
- Framebuffer layer;
- Virtio drivers;
- Xen hypervisor drivers;
- AFS file system;
- BTRFS file system;
- File systems infrastructure;
- Ceph distributed file system;
- EROFS file system;
- Ext4 file system;
- F2FS file system;
- GFS2 file system;
- JFS file system;
- Network file systems library;
- Network file system (NFS) client;
- Network file system (NFS) server daemon;
- NILFS2 file system;
- File system notification infrastructure;
- NTFS3 file system;
- Proc file system;
- SMB network file system;
- UBI file system;
- BPF subsystem;
- Network file system (NFS) superblock;
- Virtio network driver;
- Bluetooth subsystem;
- Network traffic control;
- Network sockets;
- TCP network protocol;
- Tracing infrastructure;
- User-space API (UAPI);
- Kernel init infrastructure;
- io_uring subsystem;
- IPC subsystem;
- Perf events;
- Kernel fork() syscall;
- Kernel thread helper (kthread);
- Padata parallel execution mechanism;
- RCU subsystem;
- Arbitrary resource management;
- Scheduler infrastructure;
- Signal handling mechanism;
- Static call mechanism;
- Task handling mechanism;
- Timer substystem drivers;
- Maple Tree data structure library;
- Memory management;
- 9P file system network protocol;
- Ethernet bridge;
- CAN network layer;
- Networking core;
- DCCP (Datagram Congestion Control Protocol);
- Distributed Switch Architecture;
- IPv4 networking;
- IPv6 networking;
- IUCV driver;
- L2TP protocol;
- MAC80211 subsystem;
- IEEE 802.15.4 subsystem;
- Multipath TCP;
- NCSI (Network Controller Sideband Interface) driver;
- Netfilter;
- Netlink;
- RxRPC session sockets;
- SCTP protocol;
- SMC sockets;
- Sun RPC protocol;
- TIPC protocol;
- Unix domain sockets;
- VMware vSockets driver;
- Wireless networking;
- eXpress Data Path;
- XFRM subsystem;
- AppArmor security module;
- Integrity Measurement Architecture(IMA) framework;
- Key management;
- ALSA framework;
- FireWire sound drivers;
- AudioScience HPI driver;
- HD-audio driver;
- SoC Audio for Freescale CPUs drivers;
- Intel ASoC drivers;
- MediaTek ASoC drivers;
- QCOM ASoC drivers;
- SoC audio core drivers;
- STMicroelectronics SoC drivers;
- USB sound devices;
- KVM core;
(CVE-2024-53192, CVE-2024-53130, CVE-2024-53234, CVE-2024-49986,
CVE-2024-49948, CVE-2024-49976, CVE-2024-53158, CVE-2024-50142,
CVE-2024-53160, CVE-2024-50124, CVE-2024-50055, CVE-2024-56744,
CVE-2024-53128, CVE-2024-50204, CVE-2024-50176, CVE-2024-50294,
CVE-2024-50166, CVE-2024-49906, CVE-2024-50074, CVE-2024-47734,
CVE-2024-50249, CVE-2024-53216, CVE-2024-53162, CVE-2024-50189,
CVE-2024-53196, CVE-2024-49969, CVE-2024-53210, CVE-2024-50300,
CVE-2024-47714, CVE-2024-50158, CVE-2024-49983, CVE-2024-49959,
CVE-2024-49985, CVE-2024-53078, CVE-2024-53180, CVE-2024-50099,
CVE-2024-50009, CVE-2024-53059, CVE-2024-49962, CVE-2024-56755,
CVE-2024-50106, CVE-2024-53184, CVE-2024-53063, CVE-2024-50161,
CVE-2024-50289, CVE-2024-56705, CVE-2024-56697, CVE-2024-53135,
CVE-2024-47676, CVE-2024-53084, CVE-2024-50270, CVE-2024-50078,
CVE-2024-50247, CVE-2024-50075, CVE-2024-49946, CVE-2024-50209,
CVE-2024-53048, CVE-2024-53071, CVE-2024-49930, CVE-2024-50174,
CVE-2024-50039, CVE-2024-50115, CVE-2024-56680, CVE-2024-49901,
CVE-2024-49971, CVE-2024-50180, CVE-2024-50061, CVE-2024-47681,
CVE-2024-50107, CVE-2024-49972, CVE-2024-49889, CVE-2024-49872,
CVE-2024-50067, CVE-2024-47718, CVE-2024-50246, CVE-2024-53090,
CVE-2024-49961, CVE-2024-56549, CVE-2024-47688, CVE-2024-50073,
CVE-2024-47716, CVE-2024-49952, CVE-2024-56749, CVE-2024-47737,
CVE-2024-56739, CVE-2024-56752, CVE-2024-47700, CVE-2024-56741,
CVE-2024-50196, CVE-2024-49881, CVE-2024-50230, CVE-2024-50020,
CVE-2024-49992, CVE-2024-56534, CVE-2024-49883, CVE-2024-50233,
CVE-2024-50057, CVE-2024-53091, CVE-2024-49886, CVE-2024-53144,
CVE-2024-50029, CVE-2024-50240, CVE-2024-56720, CVE-2024-50282,
CVE-2024-50036, CVE-2024-53126, CVE-2024-56702, CVE-2024-50101,
CVE-2024-56696, CVE-2024-50193, CVE-2024-53089, CVE-2024-50263,
CVE-2024-47707, CVE-2024-49925, CVE-2024-50178, CVE-2024-47690,
CVE-2024-53119, CVE-2024-49939, CVE-2024-50274, CVE-2024-50168,
CVE-2024-49963, CVE-2024-50220, CVE-2024-50250, CVE-2024-49966,
CVE-2024-50104, CVE-2024-49968, CVE-2024-47685, CVE-2024-50281,
CVE-2024-50190, CVE-2024-50181, CVE-2024-50304, CVE-2022-49034,
CVE-2024-47726, CVE-2024-50159, CVE-2024-49851, CVE-2024-49933,
CVE-2024-50277, CVE-2024-56729, CVE-2024-49885, CVE-2024-53068,
CVE-2024-50162, CVE-2024-50179, CVE-2024-53072, CVE-2024-47742,
CVE-2024-53083, CVE-2024-50025, CVE-2023-52917, CVE-2024-50269,
CVE-2024-50302, CVE-2024-50293, CVE-2024-50177, CVE-2024-53075,
CVE-2024-50257, CVE-2024-49995, CVE-2024-53076, CVE-2024-49940,
CVE-2024-50114, CVE-2024-50043, CVE-2024-47713, CVE-2024-53081,
CVE-2024-50151, CVE-2024-50211, CVE-2024-53047, CVE-2024-50016,
CVE-2024-56679, CVE-2024-56689, CVE-2024-50008, CVE-2024-47723,
CVE-2024-50285, CVE-2024-49899, CVE-2024-50098, CVE-2024-50000,
CVE-2024-53098, CVE-2024-53175, CVE-2024-49888, CVE-2024-50132,
CVE-2024-49964, CVE-2024-53042, CVE-2024-50295, CVE-2024-50038,
CVE-2024-49905, CVE-2024-50012, CVE-2024-47754, CVE-2024-50017,
CVE-2024-53095, CVE-2024-49978, CVE-2024-56541, CVE-2024-49891,
CVE-2024-50033, CVE-2024-50292, CVE-2024-50037, CVE-2024-53145,
CVE-2024-56747, CVE-2024-50260, CVE-2024-53177, CVE-2024-53229,
CVE-2024-53221, CVE-2024-56677, CVE-2024-53171, CVE-2024-50299,
CVE-2024-50202, CVE-2024-53208, CVE-2024-53105, CVE-2024-50006,
CVE-2024-50149, CVE-2024-50275, CVE-2024-47753, CVE-2024-50212,
CVE-2024-49855, CVE-2024-50145, CVE-2024-53120, CVE-2024-53061,
CVE-2024-53217, CVE-2024-53198, CVE-2024-50165, CVE-2024-49866,
CVE-2024-49994, CVE-2024-50109, CVE-2024-50137, CVE-2024-50245,
CVE-2024-53154, CVE-2024-56724, CVE-2024-53187, CVE-2024-53202,
CVE-2024-49927, CVE-2024-50163, CVE-2024-50152, CVE-2024-53220,
CVE-2024-47741, CVE-2024-50102, CVE-2024-53188, CVE-2024-53116,
CVE-2024-47695, CVE-2024-47702, CVE-2024-49970, CVE-2024-50155,
CVE-2024-53058, CVE-2024-49908, CVE-2024-50256, CVE-2024-53161,
CVE-2024-49893, CVE-2024-53074, CVE-2024-50144, CVE-2024-53219,
CVE-2024-49869, CVE-2024-53133, CVE-2024-50041, CVE-2024-49974,
CVE-2024-50287, CVE-2024-50133, CVE-2024-53183, CVE-2024-49997,
CVE-2024-47749, CVE-2024-53153, CVE-2024-50063, CVE-2024-49852,
CVE-2024-50259, CVE-2024-50013, CVE-2024-56751, CVE-2024-53236,
CVE-2024-49999, CVE-2024-50076, CVE-2024-49923, CVE-2024-50288,
CVE-2024-49867, CVE-2024-49887, CVE-2024-53101, CVE-2024-56725,
CVE-2024-56745, CVE-2024-49863, CVE-2024-49890, CVE-2024-50187,
CVE-2024-50200, CVE-2024-47679, CVE-2024-50077, CVE-2024-50069,
CVE-2024-53114, CVE-2024-50071, CVE-2024-50072, CVE-2024-47705,
CVE-2024-50205, CVE-2024-49975, CVE-2024-50237, CVE-2024-53092,
CVE-2024-49917, CVE-2024-49853, CVE-2024-50103, CVE-2024-53190,
CVE-2024-53215, CVE-2024-50280, CVE-2024-50014, CVE-2024-47756,
CVE-2024-53231, CVE-2024-49856, CVE-2024-50023, CVE-2024-53123,
CVE-2024-56756, CVE-2024-50140, CVE-2024-56699, CVE-2024-47703,
CVE-2024-49958, CVE-2024-56692, CVE-2024-50082, CVE-2024-53181,
CVE-2024-47699, CVE-2024-50154, CVE-2024-49960, CVE-2024-53226,
CVE-2024-56683, CVE-2024-53239, CVE-2024-53104, CVE-2024-50044,
CVE-2024-50255, CVE-2024-50021, CVE-2024-50070, CVE-2024-47740,
CVE-2024-49882, CVE-2024-50232, CVE-2024-47708, CVE-2024-47747,
CVE-2024-49929, CVE-2024-56693, CVE-2024-53124, CVE-2024-50223,
CVE-2024-50265, CVE-2024-53172, CVE-2024-50197, CVE-2024-49915,
CVE-2024-53224, CVE-2024-47684, CVE-2024-50217, CVE-2024-50286,
CVE-2024-47677, CVE-2024-49942, CVE-2024-50026, CVE-2024-50236,
CVE-2024-50086, CVE-2024-50153, CVE-2024-47675, CVE-2024-53112,
CVE-2024-50138, CVE-2024-53045, CVE-2024-53170, CVE-2024-50095,
CVE-2024-50188, CVE-2024-50173, CVE-2024-50019, CVE-2024-50117,
CVE-2024-47746, CVE-2024-50172, CVE-2024-53166, CVE-2024-56721,
CVE-2024-50266, CVE-2024-47696, CVE-2024-47719, CVE-2024-49892,
CVE-2024-56678, CVE-2024-47680, CVE-2024-50296, CVE-2024-53152,
CVE-2024-56536, CVE-2024-50042, CVE-2024-49894, CVE-2024-49897,
CVE-2024-47671, CVE-2024-53064, CVE-2024-53077, CVE-2024-49903,
CVE-2024-53169, CVE-2024-50011, CVE-2024-47710, CVE-2024-53046,
CVE-2024-50046, CVE-2024-53131, CVE-2024-53237, CVE-2024-56707,
CVE-2024-49950, CVE-2024-53079, CVE-2024-56694, CVE-2024-53106,
CVE-2024-49900, CVE-2024-47745, CVE-2024-50301, CVE-2024-50040,
CVE-2024-50183, CVE-2024-56532, CVE-2024-56698, CVE-2024-53139,
CVE-2024-47721, CVE-2024-50062, CVE-2024-50129, CVE-2024-50027,
CVE-2024-49941, CVE-2024-53199, CVE-2024-50185, CVE-2024-49858,
CVE-2024-50024, CVE-2024-50146, CVE-2024-50088, CVE-2024-53111,
CVE-2024-50244, CVE-2024-47697, CVE-2024-53108, CVE-2024-49896,
CVE-2024-49859, CVE-2024-56748, CVE-2024-50111, CVE-2024-53056,
CVE-2024-50283, CVE-2024-49955, CVE-2024-47706, CVE-2024-53214,
CVE-2024-47712, CVE-2024-47678, CVE-2024-53125, CVE-2024-53178,
CVE-2024-53232, CVE-2024-49928, CVE-2024-47731, CVE-2024-53121,
CVE-2024-56540, CVE-2024-50271, CVE-2024-53044, CVE-2024-53132,
CVE-2024-53052, CVE-2024-50195, CVE-2024-50191, CVE-2024-47694,
CVE-2024-49973, CVE-2024-49910, CVE-2024-56746, CVE-2024-56674,
CVE-2024-49871, CVE-2024-50258, CVE-2024-50049, CVE-2024-49951,
CVE-2024-50182, CVE-2024-53174, CVE-2024-50143, CVE-2024-53203,
CVE-2024-53129, CVE-2024-50224, CVE-2024-49943, CVE-2024-50131,
CVE-2024-50221, CVE-2024-53143, CVE-2024-56531, CVE-2024-53055,
CVE-2024-50135, CVE-2024-50279, CVE-2024-50120, CVE-2024-53140,
CVE-2024-50272, CVE-2024-47728, CVE-2024-53167, CVE-2024-56691,
CVE-2024-53223, CVE-2024-49919, CVE-2024-53082, CVE-2024-53213,
CVE-2024-50298, CVE-2024-56681, CVE-2024-53069, CVE-2024-50001,
CVE-2024-50083, CVE-2024-50056, CVE-2024-56544, CVE-2024-49989,
CVE-2024-50251, CVE-2024-50121, CVE-2024-53228, CVE-2024-56700,
CVE-2024-49862, CVE-2024-49870, CVE-2024-50148, CVE-2024-53138,
CVE-2024-50160, CVE-2024-50002, CVE-2024-56533, CVE-2024-46869,
CVE-2024-50118, CVE-2024-50276, CVE-2024-50226, CVE-2024-53146,
CVE-2024-53134, CVE-2024-53165, CVE-2024-56728, CVE-2024-49931,
CVE-2024-50261, CVE-2024-50064, CVE-2024-47711, CVE-2024-53157,
CVE-2024-53113, CVE-2024-49898, CVE-2024-50214, CVE-2024-53085,
CVE-2024-49924, CVE-2024-49944, CVE-2024-47686, CVE-2024-53238,
CVE-2024-56754, CVE-2024-50066, CVE-2024-53189, CVE-2024-49864,
CVE-2024-50093, CVE-2024-50060, CVE-2024-56684, CVE-2024-49861,
CVE-2024-50243, CVE-2024-50007, CVE-2024-50227, CVE-2024-50238,
CVE-2024-49918, CVE-2024-53227, CVE-2024-50119, CVE-2024-53088,
CVE-2024-53100, CVE-2024-47693, CVE-2024-53197, CVE-2024-49932,
CVE-2024-53163, CVE-2024-53118, CVE-2024-47733, CVE-2024-49913,
CVE-2024-56545, CVE-2024-47739, CVE-2024-47709, CVE-2024-50015,
CVE-2024-56690, CVE-2024-56535, CVE-2024-50167, CVE-2024-49965,
CVE-2024-53043, CVE-2024-50092, CVE-2024-50128, CVE-2024-53080,
CVE-2024-56539, CVE-2024-50222, CVE-2024-47724, CVE-2024-49980,
CVE-2024-49860, CVE-2024-50034, CVE-2024-47682, CVE-2024-49949,
CVE-2024-49935, CVE-2024-49914, CVE-2024-47732, CVE-2024-47701,
CVE-2024-53200, CVE-2024-50123, CVE-2024-50100, CVE-2024-56704,
CVE-2024-53115, CVE-2024-49879, CVE-2024-50096, CVE-2024-53062,
CVE-2024-50094, CVE-2024-50105, CVE-2024-49947, CVE-2024-50252,
CVE-2024-56537, CVE-2024-49953, CVE-2024-53067, CVE-2024-50091,
CVE-2024-53148, CVE-2024-50164, CVE-2024-50231, CVE-2024-49874,
CVE-2024-47750, CVE-2024-50206, CVE-2024-50207, CVE-2024-56742,
CVE-2024-50005, CVE-2024-56687, CVE-2024-50157, CVE-2024-50201,
CVE-2024-49921, CVE-2024-56727, CVE-2024-50136, CVE-2024-50126,
CVE-2024-50239, CVE-2024-50268, CVE-2024-50234, CVE-2024-50085,
CVE-2024-47736, CVE-2024-49911, CVE-2024-50198, CVE-2024-47704,
CVE-2024-53233, CVE-2024-49981, CVE-2024-53053, CVE-2024-50139,
CVE-2024-49895, CVE-2024-56688, CVE-2024-50031, CVE-2024-49916,
CVE-2024-53155, CVE-2024-50035, CVE-2024-53230, CVE-2024-47738,
CVE-2024-53099, CVE-2024-53212, CVE-2024-47743, CVE-2024-56701,
CVE-2024-53151, CVE-2024-49934, CVE-2024-53141, CVE-2024-50059,
CVE-2024-49922, CVE-2024-50215, CVE-2024-50022, CVE-2024-50229,
CVE-2024-50184, CVE-2024-50065, CVE-2024-50242, CVE-2024-50003,
CVE-2024-47715, CVE-2024-53093, CVE-2024-49956, CVE-2024-49868,
CVE-2024-49878, CVE-2024-56722, CVE-2024-53156, CVE-2024-49857,
CVE-2024-53110, CVE-2024-47735, CVE-2024-53168, CVE-2024-56543,
CVE-2024-50080, CVE-2024-50068, CVE-2024-49909, CVE-2024-56708,
CVE-2024-50134, CVE-2024-50262, CVE-2024-50303, CVE-2024-50203,
CVE-2024-49957, CVE-2024-50087, CVE-2024-53065, CVE-2024-49920,
CVE-2024-49880, CVE-2024-50110, CVE-2024-49877, CVE-2024-47692,
CVE-2024-50127, CVE-2024-49907, CVE-2024-49937, CVE-2024-49987,
CVE-2024-50141, CVE-2024-56538, CVE-2024-49865, CVE-2024-47689,
CVE-2024-50218, CVE-2024-47720, CVE-2024-53191, CVE-2024-53194,
CVE-2024-50216, CVE-2024-50213, CVE-2024-49988, CVE-2024-53094,
CVE-2024-50186, CVE-2024-50010, CVE-2024-50169, CVE-2024-53107,
CVE-2024-47698, CVE-2024-53142, CVE-2024-49945, CVE-2024-49873,
CVE-2024-53176, CVE-2024-49884, CVE-2024-50112, CVE-2024-50199,
CVE-2024-53122, CVE-2024-50284, CVE-2024-50208, CVE-2024-53218,
CVE-2024-50045, CVE-2024-50028, CVE-2024-50122, CVE-2024-50291,
CVE-2024-50047, CVE-2024-50090, CVE-2024-49876, CVE-2024-47730,
CVE-2024-53195, CVE-2024-56703, CVE-2024-49996, CVE-2024-49954,
CVE-2024-47757, CVE-2024-47717, CVE-2024-49850, CVE-2024-50273,
CVE-2024-47752, CVE-2024-53149, CVE-2024-53173, CVE-2024-50235,
CVE-2024-50150, CVE-2024-50030, CVE-2024-50079, CVE-2024-56546,
CVE-2024-53086, CVE-2024-53150, CVE-2024-49979, CVE-2024-50058,
CVE-2024-50171, CVE-2024-56685, CVE-2024-50254, CVE-2024-47751,
CVE-2024-53193, CVE-2024-53209, CVE-2024-49926, CVE-2024-47748,
CVE-2024-53109, CVE-2024-53066, CVE-2024-50225, CVE-2024-53137,
CVE-2024-50113, CVE-2024-49912, CVE-2024-49998, CVE-2024-50116,
CVE-2024-49977, CVE-2024-47687, CVE-2024-50084, CVE-2024-49982,
CVE-2024-50253, CVE-2024-50290, CVE-2024-47727, CVE-2024-50248,
CVE-2024-50170, CVE-2024-47691, CVE-2024-53147, CVE-2024-50192,
CVE-2024-53117, CVE-2024-49938, CVE-2024-47744, CVE-2024-50147,
CVE-2024-49991, CVE-2024-50048, CVE-2024-53127, CVE-2024-49902,
CVE-2024-50156, CVE-2024-53087, CVE-2024-56548, CVE-2024-50125,
CVE-2024-56723, CVE-2024-50108, CVE-2024-53049, CVE-2024-50081,
CVE-2024-56726, CVE-2024-49875, CVE-2024-50194, CVE-2024-50278,
CVE-2024-49904, CVE-2024-50267, CVE-2024-50297, CVE-2024-50130,
CVE-2024-49936)
2 days 19 hours ago
Bing Shi discovered that Libtasn1 inefficiently handled certificates. An
attacker could possibly use this issue to increase resource utilization
leading to a denial of service.
2 days 21 hours ago
USN-7270-1 fixed a vulnerability in OpenSSH. This update provides
the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Original advisory details:
It was discovered that the OpenSSH client incorrectly handled the
non-default VerifyHostKeyDNS option. If that option were enabled, an
attacker could possibly impersonate a server by completely bypassing the
server identity check. (CVE-2025-26465)
2 days 21 hours ago
It was discovered that Atril incorrectly handled certain PDF files.
An attacker could possibly use this issue to cause a denial of service
or to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS.
(CVE-2019-1010006)
Andy Nguyen discovered that Atril incorrectly handled certain images. An
attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 16.04 LTS. (CVE-2019-11459)
Febin Mon Saji discovered that Atril incorrectly handled certain
compressed files. A remote attacker could possibly use this issue to
cause a denial of service or to execute arbitrary code. (CVE-2023-51698)
2 days 22 hours ago
It was discovered that libsndfile incorrectly handled memory when executing
its FLAC codec. If a user or automated system were tricked into processing
a specially crafted sound file, an attacker could possibly use this issue
to cause a denial of service or obtain sensitive information.
(CVE-2021-4156)
It was discovered that libsndfile incorrectly handled certain malformed
OggVorbis files. An attacker could possibly use this issue to cause
libsndfile to crash, resulting in a denial of service. (CVE-2024-50612)
2 days 23 hours ago
Soner Sayakci discovered that Symfony incorrectly handled cookie storage in
the web cache. An attacker could possibly use this issue to obtain
sensitive information and access unauthorized resources. (CVE-2022-24894)
Marco Squarcina discovered that Symfony incorrectly handled the storage of
user session information. An attacker could possibly use this issue to
perform a cross-site request forgery (CSRF) attack. (CVE-2022-24895)
Pierre Rudloff discovered that Symfony incorrectly checked HTML input. An
attacker could possibly use this issue to perform cross site scripting.
(CVE-2023-46734)
Vladimir Dusheyko discovered that Symfony incorrectly sanitized special
input with a PHP directive in URL query strings. An attacker could possibly
use this issue to expose sensitive information or cause a denial of
service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 22.04 LTS.
(CVE-2024-50340)
Oleg Andreyev, Antoine Makdessi, and Moritz Rauch discovered that Symfony
incorrectly handled user authentication. An attacker could possibly use
this issue to access unauthorized resources and expose sensitive
information. This issue was only addressed in Ubuntu 24.04 LTS.
(CVE-2024-50341, CVE-2024-51996)
Linus Karlsson and Chris Smith discovered that Symfony returned internal
host information during host resolution. An attacker could possibly use
this issue to obtain sensitive information. This issue only affected Ubuntu
24.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-50342)
It was discovered that Symfony incorrectly parsed user input through
regular expressions. An attacker could possibly use this issue to expose
sensitive information. (CVE-2024-50343)
Sam Mush discovered that Symfony incorrectly parsed URIs with special
characters. An attacker could possibly use this issue to perform phishing
attacks. (CVE-2024-50345)
3 days 1 hour ago
It was discovered that virtualenv incorrectly handled paths when activating
virtual environments. An attacker could possibly use this issue to execute
arbitrary code.
3 days 2 hours ago
It was discovered that the OpenSSH client incorrectly handled the
non-default VerifyHostKeyDNS option. If that option were enabled, an
attacker could possibly impersonate a server by completely bypassing the
server identity check. (CVE-2025-26465)
It was discovered that OpenSSH incorrectly handled the transport-level ping
facility. A remote attacker could possibly use this issue to cause OpenSSH
clients and servers to consume resources, leading to a denial of service.
This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10.
(CVE-2025-26466)
3 days 6 hours ago
USN-7161-1 fixed CVE-2024-29018 in Ubuntu 24.04 LTS. This update fixes it
in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 24.10, and Ubuntu 24.04 LTS.
USN-7161-1 fixed CVE-2024-41110 in Ubuntu 24.10, Ubuntu 24.04 LTS, and
Ubuntu 18.04 LTS. This updates fixes it in Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS.
Original advisory details:
Yair Zak discovered that Docker could unexpectedly forward DNS requests
from internal networks in an unexpected manner. An attacker could possibly
use this issue to exfiltrate data by encoding information in DNS queries
to controlled nameservers. This issue was only addressed in
Ubuntu 24.04 LTS. (CVE-2024-29018)
Cory Snider discovered that Docker did not properly handle authorization
plugin request processing. An attacker could possibly use this issue to
bypass authorization controls by forwarding API requests without their
full body, leading to unauthorized actions. (CVE-2024-41110)
4 days 12 hours ago
Ke Sun, Paul Grosen and Alyssa Milburn discovered that some Intel®
Processors did not properly implement Finite State Machines (FSMs) in
Hardware Logic. A local privileged attacker could use this issue to cause a
denial of service. (CVE-2024-31068)
It was discovered that some Intel® Processors with Intel® SGX did not
properly restrict access to the EDECCSSA user leaf function. A local
authenticated attacker could use this issue to cause a denial of
service. (CVE-2024-36293)
Ke Sun, Alyssa Milburn, Benoit Morgan, and Erik Bjorge discovered that the
UEFI firmware for some Intel® processors did not properly restrict
access. An authenticated local attacker could use this issue to cause a
denial of service. (CVE-2024-39279)
1 week ago
It was discovered that Apache ActiveMQ incorrectly handled
authentication. A remote attacker could possibly use this issue to run
arbitrary code. (CVE-2022-41678)
It was discovered that Apache ActiveMQ incorrectly handled
deserialization. A remote attacker could possibly use this issue to run
arbitrary shell commands. (CVE-2023-46604)
Checked
1 hour 33 minutes ago
Recent content on Ubuntu security notices
Subscribe to Ubuntu feed