Most recent entries from all

ALSA-2022:8100 — Low: swtpm security and bug fix update

Affected: AlmaLinux:9: swtpm, AlmaLinux:9: swtpm-libs, AlmaLinux:9: swtpm-tools

SWTPM is a TPM emulator built on libtpms providing TPM functionality for QEMU VMs.

Security Fix(es):

* swtpm: Unchecked header size indicator against expected size (CVE-2022-23645)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2022-06088

ESSA-2022:0193 — security update for

security update for

EUVD-2026-234422

fkie_cve-2022-23645

swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3, v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds.

gsd-2022-23645

OESA-2022-1576 — swtpm security update

Affected: openEuler:20.03-LTS-SP1: swtpm, openEuler:20.03-LTS-SP2: swtpm, openEuler:20.03-LTS-SP3: swtpm

TPM emulator built on libtpms providing TPM functionality for QEMU VMs Security Fix(es): swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3, v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds.(CVE-2022-23645)

RHSA-2022:7472 — Red Hat Security Advisory: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update

QEMU: fdc: heap buffer overflow in DMA read data transfers libvirt: missing locking in nwfilterConnectNumOfNWFilters can lead to denial of service libguestfs: Buffer overflow in get_keys leads to DoS swtpm: Unchecked header size indicator against expected size

SUSE-SU-2022:1297-1 — Security update for swtpm

Security update for swtpm

Withdrawn: UBUNTU-CVE-2022-23645

Withdrawn by the publisher.

Affected: Ubuntu:22.04:LTS: swtpm

WID-SEC-W-2022-2052 — Mehrere Red Hat Enterprise Linux Pakete: Mehrere Schwachstellen

Ein lokaler Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder sonstige Auswirkungen zu verursachen.