Updated 4 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

573new WordPress flaws this week

398,071entries in the database

22,069 results · page 367 of 442

Feb 11, 2024dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX bytes, and crash, becausCVE-2023-52429 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX bytes, and crash, because of a missing check for struct dm_ioctl.target_count.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org lists.debian.org
Feb 11, 2024A vulnerability was reported in the Open vSwitch sub-component in the Linux Kernel.CVE-2024-1151 · Other software · Red Hat · reported by Red HatMedium 5.5
A vulnerability was reported in the Open vSwitch sub-component in the Linux Kernel. The flaw occurs when a recursive operation of code push recursively calls into the code block. The OVS module does not validate the stack depth, pushing too many frames and causing a stack overflow. As a result, this can lead to a crash or other related issues.
Product
Red Hat Enterprise Linux 9
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Feb 8, 2024A use-after-free flaw was found in the Linux kernel's Memory Management subsystem when a user wins two races at the same time with a fail in the mas_prev_slot fCVE-2024-1312 · Other software · Red Hat · reported by Red HatMedium 5.1
A use-after-free flaw was found in the Linux kernel's Memory Management subsystem when a user wins two races at the same time with a fail in the mas_prev_slot function. This issue could allow a local user to crash the system.
Product
Red Hat Enterprise Linux 6
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Feb 7, 2024A flaw was found in the Linux kernel's NVMe driver.CVE-2023-6536 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service.
Product
Red Hat Enterprise Linux 8
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Feb 7, 2024A flaw was found in the Linux kernel's NVMe driver.CVE-2023-6535 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service.
Product
Red Hat Enterprise Linux 8
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Feb 7, 2024A flaw was found in the Linux kernel's NVMe driver.CVE-2023-6356 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver and causing kernel panic and a denial of service.
Product
Red Hat Enterprise Linux 8
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Feb 5, 2024A race condition was found in the Linux kernel's media/dvb-core in dvbdmx_write() function.CVE-2024-24864 · Computers, phones & browsers · Linux · reported by security@openanolis.orgMedium 5.3
A race condition was found in the Linux kernel's media/dvb-core in dvbdmx_write() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.
Product
Linux kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.openanolis.cn bugzilla.openanolis.cn
Feb 5, 2024A race condition was found in the Linux kernel's media/xc4000 device driver in xc4000 xc4000_get_frequency() function.CVE-2024-24861 · Computers, phones & browsers · Linux · reported by security@openanolis.orgLow 3.3
A race condition was found in the Linux kernel's media/xc4000 device driver in xc4000 xc4000_get_frequency() function. This can result in return value overflow issue, possibly leading to malfunction or denial of service issue.
Product
Linux kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.openanolis.cn lists.debian.org
Feb 5, 2024A race condition was found in the Linux kernel's bluetooth device driver in {min,max}_key_size_set() function.CVE-2024-24860 · Computers, phones & browsers · Linux · reported by security@openanolis.orgMedium 4.6
A race condition was found in the Linux kernel's bluetooth device driver in {min,max}_key_size_set() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.
Product
Linux kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.openanolis.cn lists.debian.org
Feb 5, 2024A race condition was found in the Linux kernel's net/bluetooth in sniff_{min,max}_interval_set() function.CVE-2024-24859 · Computers, phones & browsers · Linux · reported by security@openanolis.orgMedium 4.6
A race condition was found in the Linux kernel's net/bluetooth in sniff_{min,max}_interval_set() function. This can result in a bluetooth sniffing exception issue, possibly leading denial of service.
Product
Linux kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.openanolis.cn bugzilla.openanolis.cn
Feb 5, 2024A race condition was found in the Linux kernel's net/bluetooth in {conn,adv}_{min,max}_interval_set() function.CVE-2024-24858 · Computers, phones & browsers · Linux · reported by security@openanolis.orgMedium 4.6
A race condition was found in the Linux kernel's net/bluetooth in {conn,adv}_{min,max}_interval_set() function. This can result in I2cap connection or broadcast abnormality issue, possibly leading to denial of service.
Product
Linux kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.openanolis.cn lists.debian.org
Feb 5, 2024A race condition was found in the Linux kernel's net/bluetooth device driver in conn_info_{min,max}_age_set() function.CVE-2024-24857 · Computers, phones & browsers · Linux · reported by security@openanolis.orgMedium 4.6
A race condition was found in the Linux kernel's net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.
Product
Linux kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.openanolis.cn lists.debian.org
Feb 5, 2024A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan() function.CVE-2024-24855 · Computers, phones & browsers · Linux · reported by security@openanolis.orgMedium 5
A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.
Product
Linux kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.openanolis.cn bugzilla.openanolis.cn
Feb 5, 2024A race condition was found in the Linux kernel's sound/hda device driver in snd_hdac_regmap_sync() function.CVE-2024-23196 · Computers, phones & browsers · Linux · reported by security@openanolis.orgMedium 5.3
A race condition was found in the Linux kernel's sound/hda device driver in snd_hdac_regmap_sync() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.
Product
Linux kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.openanolis.cn bugzilla.openanolis.cn
Feb 5, 2024A race condition was found in the Linux kernel's drm/exynos device driver in exynos_drm_crtc_atomic_disable() function.CVE-2024-22386 · Computers, phones & browsers · Linux · reported by security@openanolis.orgMedium 5.3
A race condition was found in the Linux kernel's drm/exynos device driver in exynos_drm_crtc_atomic_disable() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.
Product
Linux kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.openanolis.cn bugzilla.openanolis.cn
Feb 4, 2024A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the Linux Kernel.CVE-2023-6240 · Other software · Red Hat · reported by Red HatMedium 6.5
A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the Linux Kernel. This issue may allow a network attacker to decrypt ciphertexts or forge signatures, limiting the services that use that private key.
Product
Red Hat Enterprise Linux 8
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Jan 31, 2024Linux Kernel Use-After-Free VulnerabilityCVE-2024-1086 · Computers, phones & browsers · Linux · reported by cve-coordination@google.comExploitedRansomwareHigh 7.8
Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation.
Product
Kernel
On CISA’s list since
May 30, 2024 (federal fix deadline Jun 20, 2024)
What to do
Attackers are using this now. Install Linux’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com openwall.com
Jan 31, 2024A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.CVE-2024-1085 · Computers, phones & browsers · Linux · reported by cve-coordination@google.comHigh 7.8
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_setelem_catchall_deactivate() function checks whether the catch-all set element is active in the current generation instead of the next generation before freeing it, but only flags it inactive in the next generation, making it possible to free the element multiple times, leading to a double free vulnerability. We recommend upgrading past commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7.
Product
Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org kernel.dance
Jan 30, 2024A flaw was found in the Linux kernel's memory deduplication mechanism.CVE-2024-0564 · Other software · Red Hat · reported by Red HatMedium 5.3
A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel Samepage Merging (KSM), added in Linux kernel version 4.4.0-96.119, can create a side channel. When the attacker and the victim share the same host and the default setting of KSM is "max page sharing=256", it is possible for the attacker to time the unmap to merge with the victim's page. The unmapping time depends on whether it merges with the victim's page and additional physical pages are created beyond the KSM's "max page share". Through these operations, the attacker can leak the victim's page.
Product
Red Hat Enterprise Linux 6
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugs.launchpad.net
Jan 30, 2024Use After Free vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (bluetooth modules) allows Local Execution of Code.CVE-2024-21803 · Computers, phones & browsers · Linux · reported by security@openanolis.orgLow 3.5
Use After Free vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (bluetooth modules) allows Local Execution of Code. This vulnerability is associated with program files https://gitee.Com/anolis/cloud-kernel/blob/devel-5.10/net/bluetooth/af_bluetooth.C. This issue affects Linux kernel: from v2.6.12-rc2 before v6.8-rc1.
Product
Linux kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.openanolis.cn bugzilla.openanolis.cn
Jan 28, 2024A race condition was found in the Linux Kernel.CVE-2023-6200 · Other software · Red Hat · reported by Red HatHigh 7.5
A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send an ICMPv6 router advertisement packet, causing arbitrary code execution.
Product
Red Hat Enterprise Linux 6
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Jan 28, 2024A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality.CVE-2024-0841 · Other software · Red Hat · reported by Red HatMedium 6.6
A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.
Product
Red Hat Enterprise Linux 8
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Jan 25, 2024Integer Overflow or Wraparound vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (md, raid, raid5 modules) allows Forced Integer Overflow.CVE-2024-23307 · Computers, phones & browsers · Linux · reported by security@openanolis.orgMedium 4.4
Integer Overflow or Wraparound vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (md, raid, raid5 modules) allows Forced Integer Overflow.
Product
Linux kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.openanolis.cn bugzilla.openanolis.cn
Jan 25, 2024NULL Pointer Dereference vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (net, bluetooth modules) allows Overflow Buffers.CVE-2024-22099 · Computers, phones & browsers · Linux · reported by security@openanolis.orgMedium 6.3
NULL Pointer Dereference vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (net, bluetooth modules) allows Overflow Buffers. This vulnerability is associated with program files /net/bluetooth/rfcomm/core.C. This issue affects Linux kernel: v2.6.12-rc2.
Product
Linux kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.openanolis.cn lists.debian.org
Jan 23, 2024An issue was discovered in ksmbd in the Linux kernel before 6.6.10.CVE-2024-22705 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2_get_data_area_len in fs/smb/server/smb2misc.c can cause an smb_strndup_from_utf16 out-of-bounds access because the relationship between Name data and CreateContexts data is mishandled.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cdn.kernel.org git.kernel.org
Jan 23, 2024In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race condition between a nonblocking atomic commit and a driver unlCVE-2023-51043 · Computers, phones & browsers · Linux · reported by MITREHigh 7
In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race condition between a nonblocking atomic commit and a driver unload.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cdn.kernel.org github.com
Jan 23, 2024In the Linux kernel before 6.4.12, amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c has a fence use-after-free.CVE-2023-51042 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
In the Linux kernel before 6.4.12, amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c has a fence use-after-free.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cdn.kernel.org github.com
Jan 23, 2024In the Linux kernel before 6.5.9, there is a NULL pointer dereference in send_acknowledge in net/nfc/nci/spi.c.CVE-2023-46343 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
In the Linux kernel before 6.5.9, there is a NULL pointer dereference in send_acknowledge in net/nfc/nci/spi.c.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cdn.kernel.org git.kernel.org
Jan 23, 2024copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes, and crash, because of a missing param_keCVE-2024-23851 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes, and crash, because of a missing param_kernel->data_size check. This is related to ctl_ioctl.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.debian.org lists.debian.org
Jan 23, 2024In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and crash because a subvolume can be read out tCVE-2024-23850 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and crash because a subvolume can be read out too soon after its root item is inserted upon subvolume creation.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.debian.org lists.fedoraproject.org
Jan 23, 2024In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, resuCVE-2024-23849 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, resulting in out-of-bounds access.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.suse.com git.kernel.org
Jan 23, 2024In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-apCVE-2024-23848 · Other software · Siemens · reported by MITREMedium 5.5
In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c.
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lore.kernel.org lore.kernel.org
Jan 22, 2024An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel.CVE-2023-39197 · Other software · Red Hat · reported by Red HatMedium 4
An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.
Product
Red Hat Enterprise Linux 6
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Jan 22, 2024A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel.CVE-2024-0775 · Computers, phones & browsers · Linux · reported by Red HatMedium 6.7
A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This flaw allows a local user to cause an information leak problem while freeing the old quota file names before a potential failure, leading to a use-after-free.
Product
kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Jan 21, 2024A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic() CVE-2023-6531 · Other software · Red Hat · reported by Red HatHigh 7
A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.
Product
Red Hat Enterprise Linux 9
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Jan 18, 2024A flaw was found in the Netfilter subsystem in the Linux kernel.CVE-2024-0607 · Other software · Red Hat · reported by Red HatMedium 6.6
A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval() function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes are written, but `dst` is an array of u32, so each element only has space for 4 bytes. That means every iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local user to cause a denial of service or potentially break NetFilter functionality.
Product
Red Hat Enterprise Linux 6
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Jan 17, 2024An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls sockCVE-2024-0646 · Other software · Red Hat · reported by Red HatHigh 7
An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Product
Red Hat Enterprise Linux 8
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Jan 17, 2024A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux kernel’s TIPC subsystem.CVE-2024-0641 · Other software · Red Hat · reported by Red HatMedium 5.5
A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux kernel’s TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.
Product
Red Hat Enterprise Linux 6
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Jan 17, 2024A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem.CVE-2024-0639 · Other software · Red Hat · reported by Red HatMedium 5.5
A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.
Product
Red Hat Enterprise Linux 9
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Jan 16, 2024A memory leak flaw was found in the Linux kernel’s io_uring functionality in how a user registers a buffer ring with IORING_REGISTER_PBUF_RING, mmap() it, and tCVE-2024-0582 · Other software · Red Hat · reported by Red HatHigh 7.8
A memory leak flaw was found in the Linux kernel’s io_uring functionality in how a user registers a buffer ring with IORING_REGISTER_PBUF_RING, mmap() it, and then frees it. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Product
Red Hat Enterprise Linux 6
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugs.chromium.org
Jan 15, 2024An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel.CVE-2024-0565 · Computers, phones & browsers · Linux · reported by Red HatMedium 6.8
An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service.
Product
kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Jan 15, 2024A use-after-free flaw was found in the Linux Kernel.CVE-2024-0562 · Other software · Red Hat · reported by Red HatHigh 7.8
A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi_unregister is called to stop further write-back and waits for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation work after this has completed, which can result in the timer attempting to access the recently freed bdi_writeback.
Product
Red Hat Enterprise Linux 8.6 Extended Update Support
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Jan 15, 2024A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel.CVE-2023-6915 · Other software · Red Hat · reported by Red HatMedium 6.2
A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return.
Product
Red Hat Enterprise Linux 8
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Jan 11, 2024An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10.CVE-2022-48619 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause a denial of service (panic) because input_set_capability mishandles the situation in which an event code falls outside of a bitmap.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cdn.kernel.org github.com
Jan 11, 2024An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family); WCVE-2023-6040 · Other software · The Linux Kernel Organization · reported by security@ubuntu.comHigh 7.8
An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an attacker to achieve out-of-bounds access.
Product
linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com openwall.com
Jan 11, 2024A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem.CVE-2024-0443 · Other software · Red Hat · reported by Red HatMedium 5.5
A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn(), which is called when the blkcg reference count reaches 0. This circular dependency will prevent blkcg and some blkgs from being freed after they are made offline. This issue may allow an attacker with a local access to cause system instability, such as an out of memory error.
Product
Red Hat Enterprise Linux 8
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Jan 11, 2024An issue was discovered in the Linux kernel before 6.6.8.CVE-2023-51782 · Computers, phones & browsers · Linux · reported by MITREHigh 7
An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose/af_rose.c has a use-after-free because of a rose_accept race condition.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cdn.kernel.org github.com
Jan 11, 2024An issue was discovered in the Linux kernel before 6.6.8.CVE-2023-51781 · Computers, phones & browsers · Linux · reported by MITREHigh 7
An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-after-free because of an atalk_recvmsg race condition.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cdn.kernel.org github.com
Jan 11, 2024An issue was discovered in the Linux kernel before 6.6.8.CVE-2023-51780 · Computers, phones & browsers · Linux · reported by MITREHigh 7
An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because of a vcc_recvmsg race condition.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cdn.kernel.org github.com
Jan 9, 2024A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not properly initialize memory in messages passed between viCVE-2024-0340 · Other software · Red Hat · reported by Red HatMedium 4.4
A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.
Product
Red Hat Enterprise Linux 8
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.