Security bulletins and fixes
Stay informed about known security vulnerabilities and fixes for IBM Cloud Pak® for AIOps by subscribing to the security bulletins and by reviewing the list of fixed security-related vulnerabilities.
- Security bulletins
- Fixed security-related vulnerabilities in version 4.7.0
- Fixed security-related vulnerabilities in previous versions
Security bulletins
Subscribe to IBM Cloud Pak for AIOps notifications by following these steps:
-
Go to the IBM Support site
. -
Scroll to the Support basics section. Then, click the Notification settings card.
-
Log in to IBM with your IBM ID and password to continue.
-
Enter IBM Cloud Pak for AIOps in the Product lookup field. Click Subscribe.
-
In the Select document types page, select Security bulletin and Fixes > Security Vulnerability (Sec/Int). You can also select any other document types that you need to keep informed about.
-
Click Submit.
-
To configure how you receive notifications, click Delivery preferences in the banner at the beginning of the page. Edit your settings as needed.
Fixed security-related vulnerabilities in version 4.7.0
Review the following tables, which lists the fixed reported security-related vulnerabilities with IBM Cloud Pak for AIOps, and any included IBM or third-party software.
| CVE-ID | Issue | Description |
|---|---|---|
| CVE-2017-11468 |
Docker Registry denial of service | Docker Registry is vulnerable to a denial of service, caused by the failure to restrict content sizes. An attacker could exploit this vulnerability to cause memory consumption. |
| CVE-2018-15209 |
LibTIFF ChopUpSingleUncompressedStrip function denial of service | LibTIFF is vulnerable to a denial of service, caused by a heap-based buffer overflow in the ChopUpSingleUncompressedStrip in tif_dirread.c. By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2021-46939 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a flaw in the ring buffer recursion detection. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2021-47018 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a flaw related to the definition of the fixmap area. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2021-47257 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference flaw in parse dev addr. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2021-47284 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a flaw in the nj_setup function in netjet.c. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2021-47304 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a memory leak flaw in the tcp_init_transfer() function due to not reset icsk_ca_initialized. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2021-47373 |
Linux Kernel information disclosure | Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by a VPE leak on error In its_vpe_irq_domain_alloc. An attacker could exploit this vulnerability to obtain sensitive information. |
| CVE-2021-47408 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a flaw related to serialize hash resizes and cleanups. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2021-47461 |
Linux Kernel privilege escalation | Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by a race condition between writeprotect and exit_mmap(). By sending a specially crafted request, an authenticated attacker
could exploit this vulnerability to gain elevated privileges. |
| CVE-2021-47468 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a flaw with sleeping function called from invalid context. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2021-47491 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by improper input validation. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause collapse in read-only THP for filesystems. |
| CVE-2021-47548 |
Linux Kernel code execution | Linux Kernel could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an array overflow in hns_dsaf_ge_srst_by_port(). By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. |
| CVE-2021-47579 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a flaw with cgroup2 filesystem returns from mkdir without instantiating the new dentry. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2021-47624 |
Linux Kernel denial of service | In the Linux kernel, the following vulnerability has been resolved: net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change The refcount leak issues take place in an error handling path. When the 3rd argument buf doesn't match with "offline", "online" or "remove", the function simply returns -EINVAL and forgets to decrease the reference count of a rpc_xprt object and a rpc_xprt_switch object increased by rpc_sysfs_xprt_kobj_get_xprt() and rpc_sysfs_xprt_kobj_get_xprt_switch(), causing reference count leaks of both unused objects. Fix this issue by jumping to the error handling path labelled with out_put when buf matches none of "offline", "online" or "remove". |
| CVE-2023-2253 |
Distribution denial of service | Distribution is vulnerable to a denial of service, caused by improper input validation by the /v2/_catalog endpoint. By sending a specially crafted /v2/_catalog API endpoint request request, a remote attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2023-2975 |
OpenSSL security bypass | OpenSSL could allow a remote attacker to bypass security restrictions, caused by AES-SIV cipher implementation. By sending a specially-crafted request using empty data entries as associated data, an attacker could exploit this vulnerability to bypass authentication validation. |
| CVE-2023-5685 |
XNIO denial of service | XNIO is vulnerable to a denial of service, caused by a stack overflow exception when the chain of notifier states becomes problematically large. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause an uncontrolled resource management, and results in a denial of service condition. |
| CVE-2022-23471 |
containerd CRI implementation denial of service | containerd is vulnerable to a denial of service, caused by a flaw in the CRI implementation. By sending a specially-crafted request, a remote authenticated attacker could exploit this vulnerability to exhaust memory on the host, and results in a denial of service condition. |
| CVE-2022-23648 |
containerd CRI information disclosure | containerd could allow a remote attacker to obtain sensitive information, caused by a flaw in the CRI implementation. By using a specially-crafted image configuration, an attacker could exploit this vulnerability to access to read-only copies of arbitrary files and directories on the host system, and use this information to launch further attacks against the affected system. |
| CVE-2022-31030 |
containerd denial of service | containerd is vulnerable to a denial of service, caused by a flaw in the CRI implementation. By sending a specially-crafted request using the ExecSync API, a local authenticated attacker could exploit this vulnerability to cause containerd to consume all available memory on the computer, and results in a denial of service condition. |
| CVE-2022-48554 |
File buffer overflow | File is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the file_copystr function in funcs.c. By persuading a victim to open a specially crafted file, a remote attacker could overflow a buffer and execute arbitrary code or cause a denial of service condition on the system. |
| CVE-2022-48632 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a stack-based buffer overflow in mlxbf_i2c_smbus_start_transaction(). An attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2022-48743 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a skb data length underflow. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2022-48747 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a wrong offset flaw in the bio_truncate() function. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause
a denial of service condition. |
| CVE-2022-48757 |
Linux Kernel information disclosure | Linux Kernel could allow a remote authenticated attacker to obtain sensitive information, caused by incorrect default permissions in netdevice.h. By sending a specially crafted request, a remote attacker could exploit this
vulnerability to obtain sensitive information and use this information to launch further attacks against the affected system. |
| CVE-2023-22102 |
Oracle MySQL Connectors unspecified | An unspecified vulnerability in Oracle MySQL Connectors related to the Connector/J component could allow a remote attacker to cause high confidentiality, integrity and availability impacts. |
| CVE-2023-25153 |
containerd denial of service | containerd is vulnerable to a denial of service, caused by a memory exhaustion flaw when importing an OCI image. By using a specially-crafted image with a large file, a local attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2023-25173 |
containerd security bypass | containerd could allow a local authenticated attacker to bypass security restrictions, caused by improper setup for supplementary groups inside a container. By sending a specially-crafted request using supplementary group access, an attacker could exploit this vulnerability to bypass primary group restrictions. |
| CVE-2023-28746 |
Intel Atom Processors information disclosure | Intel Atom Processors could allow a local authenticated attacker to obtain sensitive information, caused by a flaw in microarchitectural state after transient execution from some register files. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system. |
| CVE-2023-52451 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an error related to access beyond end of drmem array. A local attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2023-52463 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by force RO when remounting if SetVariable is not supported. A local attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2023-52469 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a use-after-free in kv_parse_power_table. A local attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2023-52471 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference in ice_ptp.c. A local attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2023-52486 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a deadlock issue due to unref the same fb many times. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2023-52530 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by use-after-free in ieee80211_key_link in mac80211. By sending a specially crafted request, a local attacker could exploit this vulnerability to a denial of service condition. |
| CVE-2023-52619 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an error when setting number of cpus to an odd number. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2023-52622 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a flaw when online resize an ext4 filesystem with a oversized flexbg_size. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2023-52623 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a race condition related to RCU usage. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2023-52648 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a flaw related to unreferencing the plane state surface. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2023-52653 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a memory leak in the gss_import_v2_context function. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2023-52658 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a flaw related to switchdev mode with ns inconsistency. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2023-52662 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a memory leak in the vmw_gmrid_man_get_node function. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2023-52679 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a double free flaw in the of_parse_phandle_with_args_map function. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2023-52707 |
Linux Kernel code execution | Linux Kernel could allow a local authenticated attacker to execute arbitrary code on the system, caused by a use-after-free flaw in the ep_remove_wait_queue() function. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. |
| CVE-2023-52730 |
Linux Kernel Denial of Service | In the Linux kernel, the following vulnerability has been resolved: mmc: sdio: fix possible resource leaks in some error paths If sdio_add_func() or sdio_init_func() fails, sdio_remove_func() can not release the resources, because the sdio function is not presented in these two cases, it won't call of_node_put() or put_device(). |
| CVE-2023-52756 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a double shift flaw. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2023-52762 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a stack-based buffer overflow on virtio_max_dma_size. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2023-52764 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a shift-out-of-bounds in set_flicker. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2023-52777 |
Linux Kernel code execution | Linux Kernel could allow a local authenticated attacker to execute arbitrary code on the system, caused by a use-after-free flaw due to gtk offload status event locking. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. |
| CVE-2023-52784 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a flaw in the bond_setup_by_slave() function. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2023-52791 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an incomplete cleanup in the i2c module. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2023-52796 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a stack-based buffer overflow in the ipvlan module. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2023-52803 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a use-after-free in dget_parent. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2023-52811 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference flaw ibmvfc_get_event() function. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2023-52832 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an integer overflow in the ieee80211_get_tx_power() function. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2023-52834 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an DMA RX overflow issue. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2023-52845 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an error related to changing nla_policy for bearer-related names to NLA_NUL_STRING. A local authenticated attacker could exploit this vulnerability to cause a denial
of service. |
| CVE-2023-52847 |
Linux Kernel code execution | Linux Kernel could allow a local authenticated attacker to execute arbitrary code on the system, caused by a use-after-free flaw due to btv->timeout timer. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. |
| CVE-2023-52864 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a memory corruption flaw in the wmi_char_open() function. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-1135 |
Gunicorn HTTP request smuggling | Gunicorn is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding headers. By sending a specially crafted HTTP(S) transfer-encoding header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks. |
| CVE-2024-2201 |
XenSource Xen information disclosure | XenSource Xen could allow a local attacker to obtain sensitive information, caused by a new cross-privilege Spectre v2 vulnerability that impacts modern CPU architectures supporting speculative execution. By speculatively jumping to a chosen gadget, an attacker could exploit this vulnerability to read arbitrary privileged data or system registry values. |
| CVE-2024-4076 |
ISC BIND denial of service | ISC BIND is vulnerable to a denial of service, caused by an error when serving both stale cache data and authoritative zone content. By sending queries, a remote attacker could exploit this vulnerability to cause an assertion failure. |
| CVE-2024-6239 |
Poppler denial of service | Poppler is vulnerable to a denial of service, caused by improper input validation in Pdfinfo utility. By using certain malformed input files, a remote attacker could exploit this vulnerability to cause the utility to crash. |
| CVE-2024-7348 |
PostgreSQL privilege escalation | PostgreSQL could allow a remote authenticated attacker to gain elevated privileges on the system, caused by a tme-of-check time-of-use (TOCTOU) race condition in pg_dump. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to execute arbitrary SQL functions as the user running pg_dump. |
| CVE-2024-21131 |
Oracle Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition unspecified | An unspecified vulnerability in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition related to the Hotspot component could allow a remote attacker to cause low integrity impact. |
| CVE-2024-21138 |
Oracle Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition unspecified | An unspecified vulnerability in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition related to the Hotspot component could allow a remote attacker to cause a low availability impact. |
| CVE-2024-21140 |
Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition unspecified | An unspecified vulnerability in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition related to the Hotspot component could allow a remote attacker to cause low confidentiality, low integrity impacts. |
| CVE-2024-21144 |
Oracle Java SE, Oracle GraalVM Enterprise Edition unspecified | An unspecified vulnerability in Oracle Java SE, Oracle GraalVM Enterprise Edition related to the Concurrency component could allow a remote attacker to cause low availability impact. |
| CVE-2024-21145 |
Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition unspecified | An unspecified vulnerability in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition related to the 2D component could allow a remote attacker to cause low confidentiality, low integrity impacts. |
| CVE-2024-21147 |
Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition unspecified | An unspecified vulnerability in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition related to the Hotspot component could allow a remote attacker to cause high confidentiality, high integrity impacts. |
| CVE-2024-21823 |
Intel DSA and IAA denial of service | Intel DSA and IAA are vulnerable to a denial of service, caused by a hardware logic with insecure de-synchronization. A local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-24557 |
Moby weak security | Moby could provide weaker than expected security, caused by improper cache validation in the classic builder cache system. By persuading a victim to open a specially crafted file, a remote attacker could exploit this vulnerability to conduct a cache poisoning attack. |
| CVE-2024-24758 |
Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear Proxy-Authentication headers. This issue has been patched in versions
5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
|
| CVE-2024-24806 |
libuv server-side request forgery | libuv is vulnerable to server-side request forgery, caused by improper Domain lookup by the uv_getaddrinfo function in src/unix/getaddrinfo.c. By sending a specially crafted request, an attacker could exploit this vulnerability to conduct SSRF attack. |
| CVE-2024-25620 |
Helm directory traversal | Helm could allow a remote authenticated attacker to traverse directories on the system, caused by improper validation of user-supplied input. An attacker could supplying a specially-crafted Chart.yaml file containing a relative path change operation to view arbitrary files on the system. |
| CVE-2024-25739 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by improper check for unusual or exceptional conditions in the create_empty_lvol function in the drivers/mtd/ubi/vtbl.c. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-26147 |
Helm denial of service | Helm is vulnerable to a denial of service, caused by the use of an uninitialized variable in the parsing of YAML files by the LoadIndexFile or DownloadIndexFile functions. By providing a specially crafted YAML file, a remote attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-26586 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a stack corruption in mlxsw: spectrum_acl_tcam. A local attacker could exploit this vulnerability to cause a kernel panic. |
| CVE-2024-26614 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an error related to making sure init the accept_queue's spinlocks once. A local attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-26640 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by the lack of sanity checks to rx zerocopy. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-26660 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an out-of-bounds access flaw in the stream_enc_regs array within DCN301. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-26669 |
Linux Kernel information disclosure | Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by a chain template offload flaw in net/sched. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information or cause a denial of service condition. |
| CVE-2024-26686 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a hard lockup flaw in the lock_task_sighand() function. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-26698 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a race condition between netvsc_probe and netvsc_remove functions. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-26704 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a double free of blocks due to wrong extents moved_len in the ext4_move_extents() function. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-26733 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a heap-based buffer overflow in arp_req_get(). By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-26740 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a deadlock flaw when reverse flow of traffic with the redirect (egress -> ingress). By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-26772 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a flaw with allocating blocks from corrupted group in ext4_mb_find_by_goal() function. By sending a specially crafted request, a local authenticated attacker could
exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-26773 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an error related to llsec key resources release in mac802154_llsec_key_del. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-26802 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an error related to clear variable when destroying workqueue. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-26810 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a race condition when mask operations through config space changes to DisINTx. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-26837 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a race condition between generation of the list of MDB events to replay with the creation of new group memberships. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-26840 |
Linux Kernel information disclosure | Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by a memory leak in the cachefiles_add_cache() function. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system. |
| CVE-2024-26843 |
Linux Kernel information disclosure | Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by a stack-based buffer overflow in soft-reserved region size md_size. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information or cause a denial of service condition. |
| CVE-2024-26852 |
Linux Kernel code execution | Linux Kernel could allow a local authenticated attacker to execute arbitrary code on the system, caused by a use-after-free flaw in the ip6_route_mpath_notify() function. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. |
| CVE-2024-26853 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a flaw in Igc. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-26870 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a nfs4_listxattr kernel BUG at mm/usercopy.c. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-26878 |
Linux Kernel denial of service quota: Fix potential NULL pointer dereference | Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference flaw. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to a denial of service condition. |
| CVE-2024-26921 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a buffer underflow when skb fragments reassembled via netfilter or similar modules. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-26925 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an error related to netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-26940 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an error related to the creation of debugfs ttm_resource_manager entry. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-26958 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a use-after-free in direct writes. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-26960 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a race condition between free_swap_and_cache() and swapoff() in 'mm: swap'. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-26961 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an error related to llsec key resources release in mac802154_llsec_key_del. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-27010 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a mirred deadlock on device recursion. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-27011 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a memory leak in map from abort path. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-27019 |
Linux Kernel denial of service netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() | Linux Kernel is vulnerable to a denial of service, caused by potential data-race in __nft_obj_type_get() in netfilter: nf_tables. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-27020 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by potential data-race in __nft_expr_type_get() in netfilter: nf_tables. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-27025 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an error related to a null check for nla_nest_start nla_nest_start() that may fail and return NULL. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-27065 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a flaw in the table flag updates, in the netfilter: nf_tables module. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-27388 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a memory leak flaw in the gssx_dec_option_array. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-27395 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a use-after-free flaw in the ovs_ct_exit function. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-27434 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a flaw relate to setting the MFP flag for the GTK. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-28835 |
GnuTLS denial of service | GnuTLS is vulnerable to a denial of service, caused by a flaw during chain building/verification. By using a specially crafted .pem bundle using the "certtool --verify-chain" command, a remote attacker could exploit this vulnerability to cause the application to crash. |
| CVE-2024-30260 |
Node.js undici module information disclosure | Node.js undici module could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw with not clear Authorization and Proxy-Authorization headers for undici.request(). By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system. |
| CVE-2024-30261 |
Node.js undici module security bypass | Node.js undici module could allow a remote authenticated attacker to bypass security restrictions, caused by a flaw with fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect. By sending a specially crafted request, an attacker could exploit this vulnerability to allow fetch() accept requests as valid even if they have been tampered. |
| CVE-2024-31076 |
Linux Kernel information disclosure | Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by a vector leak during CPU offline. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information or cause a denial of service condition. |
| CVE-2024-32487 |
less command execution | less could allow a remote attacker to execute arbitrary commands on the system. By using a newline character in the name of a file, an attacker could exploit this vulnerability to execute arbitrary commands on the system. |
| CVE-2024-33621 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a flaw with using skb->sk in ipvlan_process_v{4,6}_outbound. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-33883 |
Node.js ejs module denial of service | Node.js ejs(Embedded JavaScript templates) module is vulnerable to a denial of service, caused by the lack of certain pollution protection. A local attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-35790 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference flaw in the DisplayPort driver. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-35801 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a flaw when CPU hotplug MSR_IA32_XFD is reset to the init_fpstate.xfd. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-35807 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a corruption during on-line resize of a file system that is larger than 16 TiB with 4k block size. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-35810 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a use-after-free flaw when manage the lifetime of the buffer objects held by the vmw_plane_state. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-35814 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a double-allocation of slots due to broken alignment handling. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-35823 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a unicode buffer corruption when deleting characters. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-35824 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a flaw related to regulators getting en-/dis-abled twice on suspend/resume. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-35847 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a double free flaw in the error handling path in its_vpe_irq_domain_alloc(). By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-35893 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a kernel-infoleak in the tcf_skbmod_dump() function. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-35896 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by improper input validation for length in BPF module. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-35897 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a flaw with discard table flag update with pending basechain deletion. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-35899 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a race condition between exit_net and the destroy workqueue. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-35900 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a flaw when trying to unregister and already unregistered chain. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-35910 |
Linux Kernel code execution | Linux Kernel could allow a local authenticated attacker to execute arbitrary code on the system, caused by a flaw with improperly terminate timers for kernel sockets. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. |
| CVE-2024-35912 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a response leaks when the rx payload length check fails, or if kmemdup() fails. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-35924 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by buffer overflow when reading for UCSI 1.2. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-35925 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a division by zero flaw in blk_rq_stat_sum(). By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-35930 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a memory leak in lpfc_rcv_padisc(). By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-35937 |
Linux Kernel information disclosure | Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by improper validation of the A-MSDU format. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information or cause a denial of service condition. |
| CVE-2024-35938 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a page allocation failure in wifi: ath11k. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-35946 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a null pointer access when abort scan. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-35947 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an old BUG_ON in >control parser A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-35952 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a soft lockup error. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-36000 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an error related to missing hugetlb_lock for resv uncharge. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-36005 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an error related to netfilter: nf_tables: honor table dormant flag from netdev release event path. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-36006 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an error related to spectrum_acl_tcam. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-36016 |
Linux Kernel privilege escalation | Linux Kernel could allow a remote attacker from within the local network to gain elevated privileges on the system, caused by an out-of-bounds write in gsm0_receive(). An attacker could exploit this vulnerability to gain elevated privileges on the system. |
| CVE-2024-36017 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an out-of-bounds read when accessing the saved (casted) entry in ivvl. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-36020 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a race condition in the Ethernet Controller XL710 family driver. A remote authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-36025 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an off-by-one in qla_edif_app_getstats(). A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-36270 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference error. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-36286 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a flaw in Netfilter: Nfnetlink_queue. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-36489 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by missing memory barrier in tls_init. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-36886 |
Linux Kernel code execution | Linux Kernel could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free when processing fragmented TIPC messages. By sending a specially crafted request, an attacker could exploit this vulnerability to execute code in the context of the kernel. |
| CVE-2024-36889 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by the failure to ensure snd_nxt is properly initialized on connect. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-36896 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an access violation during port device removal. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-36904 |
Linux Kernel privilege escalation | Linux Kernel could allow a local authenticated attacker to gain elevated privileges, caused by a use-after-free in the TCP protocol. An attacker could exploit this vulnerability to gain elevated privileges on the system. |
| CVE-2024-36905 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a divide-by-zero error. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-36917 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an integer overflow in blk_ioctl_discard(). A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-36921 |
Linux Kernel privilege escalation | Linux Kernel could allow a local authenticated attacker, caused by an out-of-bounds memory access flaw in the Wireless WiFi Link Next-Gen AGN driver. An attacker could exploit this vulnerability to gain elevated privileges on the system. |
| CVE-2024-36927 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a race condition in __ip_make_skb() KMSAN. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-36929 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an untrusted pointer reference error. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-36933 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by the use of uninitialized variable. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-36940 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a double-free in pinctrl_enable(). A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-36941 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference error. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-36950 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an error related to mask bus reset interrupts between ISR and bottom half. A local attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-36954 |
Linux Kernel information disclosure | Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by a memleak in tipc_buf_append __skb_linearize(). An attacker could exploit this vulnerability to obtain sensitive information. |
| CVE-2024-36960 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an invalid read in fence signaled events. A local authenticated attacker could exploit this vulnerability to obtain sensitive information or cause a denial of service. |
| CVE-2024-36971 |
||
| CVE-2024-36978 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an out--of-bounds write in multiq_tune(). A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-36979 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a vlan use-after-free. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-37168 |
gRPC on Node.js denial of service | gRPC on Node.js is vulnerable to a denial of service, caused by a flaw with memory allocation with excessive size value. By sending specially crafted messages, a remote attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-37890 |
Node.js ws module denial of service | Node.js ws module is vulnerable to a denial of service, caused by a NULL pointer dereference. By sending a specially crafted request with multiple HTTP headers, a remote attacker could exploit this vulnerability to cause the server to crash. |
| CVE-2024-38428 |
GNU Wget security bypass | GNU Wget could allow a remote authenticated attacker to bypass security restrictions, caused by the mishandling of semicolons in the userinfo subcomponent of a URI. By sending a specially crafted request, an attacker could exploit this vulnerability to perform unauthorized actions. |
| CVE-2024-38473 |
Apache HTTP Server security bypass | Apache HTTP Server could allow a remote attacker to bypass security restrictions, caused by an encoding flaw in mod_proxy. By sending specially crafted requests with incorrect encoding an attacker could exploit this vulnerability to bypass authentication validation. |
| CVE-2024-38475 |
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. | Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained. |
| CVE-2024-38538 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an uninit value[1] error in bridge device's xmit path. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-38555 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a use-after-free flaw when FW completion arrives while device is in internal error state. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition. |
| CVE-2024-38573 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference in cppc_cpufreq_get_rate(). A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-38575 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference in the kzalloc() in brcmf_pcie_download_fw_nvram(). A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-38596 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a race condition in unix_release_sock/unix_stream_sendmsg. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-38615 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an error related to exit() callback being optional. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-38627 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a double-free in stm_register_device(). A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-39276 |
Linux Kernel information disclosure | Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by an error related to mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find(). An attacker could exploit this vulnerability to obtain sensitive information. |
| CVE-2024-39472 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by incorrect h_size values used for the initial umount record in xfs_log_recover.c. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-39476 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an error related to deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING. A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-39487 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by an out-of-bounds read in bond_option_arp_ip_targets_set(). A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-39502 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by use-after-free in netif_napi_del(). A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-39573 |
Apache HTTP Server server-side request forgery | Apache HTTP Server is vulnerable to server-side request forgery, caused by a flaw in the mod_rewrite. By sending a specially crafted request, an attacker could exploit this vulnerability to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy. |
| CVE-2024-39936 |
Qt information disclosure | Qt could allow a remote attacker to obtain sensitive information, caused by an error in HTTP2. By sending multiple requests in-between the encrypted() signal and the abort() call, an attacker could exploit this vulnerability to obtain sensitive information. |
| CVE-2024-40927 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service caused by a deadlock in ieee80211_sta_ps_deliver_wakeup() in xhci-ring.c . A local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-40974 |
Linux Kernel denial of service | Linux Kernel is vulnerable to a denial of service, caused by a flaw in powerpc/pseries. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-42367 |
aio-libs aiohttp directory traversal | aio-libs aiohttp ould allow a remote attacker to traverse directories on the system, caused by improper archive file validation. An attacker could use a specially crafted archive file containing "dot dot" sequences (/../) to create arbitrary symlinks on the system. |
| CVE-2024-43380 |
floraison fugit denial of service | floraison fugit is vulnerable to a denial of service, caused by improper input validation by the natural parser. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition. |
Fixed security-related vulnerabilities in previous versions
Review the following documentation, which includes the list of fixed reported security-related vulnerabilities in previous versions of IBM Cloud Pak for AIOps:
- Fixed security-related vulnerabilities in version 4.6.1
- Fixed security-related vulnerabilities in version 4.6.0
- Fixed security-related vulnerabilities in version 4.5.1
- Fixed security-related vulnerabilities in version 4.5.0
- Fixed security-related vulnerabilities in version 4.4.1
- Fixed security-related vulnerabilities in version 4.4.0
- Fixed security-related vulnerabilities in version 4.3.0
- Fixed security-related vulnerabilities in version 4.2.1
- Fixed security-related vulnerabilities in version 4.2.0
- Fixed security-related vulnerabilities in version 4.1.2
- Fixed security-related vulnerabilities in version 4.1.1
- Fixed security-related vulnerabilities in version 4.1.0