Most recent entries from all

2NGA002579 — ABB Arctic communication solution ARM600 Vulnerabilities

ABB is aware of public reports of a vulnerabilities in product versions listed as affected in this advisory. An attacker who successfully exploited these vulnerabilities could cause the product to stop, make the product inacces-sible, take remote control of the product or insert and run arbitrary code. As part of ABB product lifecycle policy, once a product transitions to end-of-life, we discontinue maintenance, security patches, and technical support to focus on current and future technologies. While the product will continue to function, we strongly recommend implementing mitigations defined in this document, such as using a private APN cellular network between Arctic wireless gateways and ARM600 for establishing VPN tunnels, to mitigate security risks and avoid potential vulnerabilities. As part of ABB product lifecycle policy, once a product transitions to Limited state, we discontinue maintenance, security patches, and technical support to focus on current and future technologies. While the product will continue to function, we strongly recommend implementing mitigations defined in this document to mitigate security risks.

ALSA-2023:5068 — Moderate: linux-firmware security update

Affected: AlmaLinux:9: iwl100-firmware, AlmaLinux:9: iwl1000-firmware, AlmaLinux:9: iwl105-firmware, AlmaLinux:9: iwl135-firmware, AlmaLinux:9: iwl2000-firmware, AlmaLinux:9: iwl2030-firmware, AlmaLinux:9: iwl3160-firmware, AlmaLinux:9: iwl5000-firmware, AlmaLinux:9: iwl5150-firmware, AlmaLinux:9: iwl6000g2a-firmware and 7 more

The linux-firmware packages contain all of the firmware files that are required by various devices to operate.

Security Fix(es):

* hw: amd: Cross-Process Information Leak (CVE-2023-20593)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2023-03992

BELL-CVE-2023-20593

Affected: Alpaquita:23: linux-firmware

certfr-2023-avi-0582 — Une vulnérabilité a été découverte dans Citrix. Elle permet à un attaquant de provoquer une…

certfr-2023-avi-0582

EUVD-2026-216188

fkie_cve-2023-20593

An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.

gsd-2023-20593

ICSA-24-046-11 — Siemens SCALANCE XCM-/XRM-300

A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash.

This issue affects Apache HTTP Server 2.4.54 and earlier. A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability. A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability. An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations when the guest provides invalid values for the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service. A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create…

openSUSE-SU-2024:13080-1 — kernel-devel-6.4.6-1.1 on GA media

kernel-devel-6.4.6-1.1 on GA media

RHSA-2023:4696 — Red Hat Security Advisory: kernel security update

hw: amd: Cross-Process Information Leak kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege escalation

SUSE-SU-2023:2986-1 — Security update for kernel-firmware

Security update for kernel-firmware

UBUNTU-CVE-2023-20593

Affected: Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:14.04:LTS: amd64-microcode, Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:16.04:LTS: amd64-microcode, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure and 146 more

An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.

WID-SEC-W-2023-1873 — AMD Prozessor: Schwachstelle ermöglicht Offenlegung von Informationen

Ein lokaler Angreifer kann eine Schwachstelle im AMD Prozessor ausnutzen, um Informationen offenzulegen.