Category Archives: Advisories

USN-5692-1: Linux kernel vulnerabilities

Read Time:1 Minute, 21 Second

David Bouman and Billy Jheng Bing Jhong discovered that a race condition
existed in the io_uring subsystem in the Linux kernel, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2022-2602)

Sönke Huster discovered that an integer overflow vulnerability existed in
the WiFi driver stack in the Linux kernel, leading to a buffer overflow. A
physically proximate attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2022-41674)

Sönke Huster discovered that a use-after-free vulnerability existed in the
WiFi driver stack in the Linux kernel. A physically proximate attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2022-42719)

Sönke Huster discovered that the WiFi driver stack in the Linux kernel did
not properly perform reference counting in some situations, leading to a
use-after-free vulnerability. A physically proximate attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2022-42720)

Sönke Huster discovered that the WiFi driver stack in the Linux kernel did
not properly handle BSSID/SSID lists in some situations. A physically
proximate attacker could use this to cause a denial of service (infinite
loop). (CVE-2022-42721)

Sönke Huster discovered that the WiFi driver stack in the Linux kernel
contained a NULL pointer dereference vulnerability in certain situations. A
physically proximate attacker could use this to cause a denial of service
(system crash). (CVE-2022-42722)

Read More

USN-5691-1: Linux kernel vulnerabilities

Read Time:57 Second

David Bouman and Billy Jheng Bing Jhong discovered that a race condition
existed in the io_uring subsystem in the Linux kernel, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2022-2602)

Sönke Huster discovered that an integer overflow vulnerability existed in
the WiFi driver stack in the Linux kernel, leading to a buffer overflow. A
physically proximate attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2022-41674)

Sönke Huster discovered that the WiFi driver stack in the Linux kernel did
not properly perform reference counting in some situations, leading to a
use-after-free vulnerability. A physically proximate attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2022-42720)

Sönke Huster discovered that the WiFi driver stack in the Linux kernel did
not properly handle BSSID/SSID lists in some situations. A physically
proximate attacker could use this to cause a denial of service (infinite
loop). (CVE-2022-42721)

Read More

qemu-7.0.0-10.fc37

Read Time:14 Second

FEDORA-2022-4387579e67

Packages in this update:

qemu-7.0.0-10.fc37

Update description:

vga: avoid crash if no default vga card (rhbz#2095639)
lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216)
vnc-clipboard: fix integer underflow (CVE-2022-3165)

Read More

CVE-2013-4253

Read Time:9 Second

The deployment script in the unsupported “OpenShift Extras” set of add-on scripts, in Red Hat Openshift 1, installs a default public key in the root user’s authorized_keys file.

Read More

CVE-2013-4281

Read Time:11 Second

In Red Hat Openshift 1, weak default permissions are applied to the /etc/openshift/server_priv.pem file on the broker server, which could allow users with local access to the broker to read this file.

Read More

dotnet6.0-6.0.109-1.fc35

Read Time:15 Second

FEDORA-2022-34a610d9bf

Packages in this update:

dotnet6.0-6.0.109-1.fc35

Update description:

This is the monthly .NET 6 update for September 2022. It updates the .NET SDK to 6.0.109 and Runtime to 6.0.9.

This includes a fix for CVE-2022-38013

Read More

dotnet6.0-6.0.109-1.fc36

Read Time:15 Second

FEDORA-2022-d80b1d2827

Packages in this update:

dotnet6.0-6.0.109-1.fc36

Update description:

This is the monthly .NET 6 update for September 2022. It updates the .NET SDK to 6.0.109 and Runtime to 6.0.9.

This includes a fix for CVE-2022-38013

Read More

dotnet6.0-6.0.109-1.fc37

Read Time:15 Second

FEDORA-2022-13046bb867

Packages in this update:

dotnet6.0-6.0.109-1.fc37

Update description:

This is the monthly .NET 6 update for September 2022. It updates the .NET SDK to 6.0.109 and Runtime to 6.0.9.

This includes a fix for CVE-2022-38013

Read More