Security Warnings — Week: 2024-W41

Microsoft Edge (Chromium-based) Spoofing Vulnerability

2024-10-08 CVE-2024-43577

mediumMicrosoft MSRC 2024-W41

Microsoft Edge (Chromium-based) Spoofing Vulnerability

2024-10-08 CVE-2024-43580

mediumMicrosoft MSRC 2024-W41

Microsoft Excel Remote Code Execution Vulnerability

2024-10-08 CVE-2024-43504

highMicrosoft MSRC 2024-W41

Microsoft Management Console Remote Code Execution Vulnerability

2024-10-08 CVE-2024-43572

highMicrosoft MSRC 2024-W41

Microsoft Office Remote Code Execution Vulnerability

2024-10-08 CVE-2024-43576

highMicrosoft MSRC 2024-W41

Microsoft Office Remote Code Execution Vulnerability

2024-10-08 CVE-2024-43616

highMicrosoft MSRC 2024-W41

Microsoft Office Spoofing Vulnerability

2024-10-08 CVE-2024-43609

mediumMicrosoft MSRC 2024-W41

Microsoft Office Visio Remote Code Execution Vulnerability

2024-10-08 CVE-2024-43505

highMicrosoft MSRC 2024-W41

Microsoft OpenSSH for Windows Remote Code Execution Vulnerability

2024-10-08 CVE-2024-38029

highMicrosoft MSRC 2024-W41

Microsoft OpenSSH for Windows Remote Code Execution Vulnerability

2024-10-08 CVE-2024-43581

highMicrosoft MSRC 2024-W41

Microsoft OpenSSH for Windows Remote Code Execution Vulnerability

2024-10-08 CVE-2024-43615

highMicrosoft MSRC 2024-W41

Microsoft SharePoint Elevation of Privilege Vulnerability

2024-10-08 CVE-2024-43503

highMicrosoft MSRC 2024-W41

Microsoft Simple Certificate Enrollment Protocol Denial of Service Vulnerability

2024-10-08 CVE-2024-43541

highMicrosoft MSRC 2024-W41

Microsoft Simple Certificate Enrollment Protocol Denial of Service Vulnerability

2024-10-08 CVE-2024-43544

highMicrosoft MSRC 2024-W41

Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability

2024-10-08 CVE-2024-43574

highMicrosoft MSRC 2024-W41

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

2024-10-08 CVE-2024-43519

highMicrosoft MSRC 2024-W41

Microsoft Windows Management Console Remote Code Execution Vulnerability

2024-10-08 CVE-2024-43572

highMicrosoft CVE 2024-W41

Microsoft Windows MSHTML Platform Spoofing Vulnerability

2024-10-08 CVE-2024-43573

highMicrosoft CVE 2024-W41

Microsoft Windows Storage Port Driver Elevation of Privilege Vulnerability

2024-10-08 CVE-2024-43560

highMicrosoft MSRC 2024-W41

mm, slub: avoid zeroing kmalloc redzone

2024-10-08 CVE-2024-49885

mediumMicrosoft MSRC 2024-W41

mm: avoid leaving partial pfn mappings around in error case

2024-10-08 CVE-2024-47674

mediumMicrosoft MSRC 2024-W41

mm: call the security_mmap_file() LSM hook in remap_file_pages()

2024-10-08 CVE-2024-47745

highMicrosoft MSRC 2024-W41

mm/mremap: fix move_normal_pmd/retract_page_tables race

2024-10-08 CVE-2024-50066

highMicrosoft MSRC 2024-W41

mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow

2024-10-08 CVE-2024-50085

mediumMicrosoft MSRC 2024-W41

nbd: fix race between timeout and normal completion

2024-10-08 CVE-2024-49855

highMicrosoft MSRC 2024-W41

net: ethernet: lantiq_etop: fix memory disclosure

2024-10-08 CVE-2024-49997

highMicrosoft MSRC 2024-W41

net: microchip: vcap api: Fix memory leaks in vcap_api_encode_rule_test()

2024-10-08 CVE-2024-50084

highMicrosoft MSRC 2024-W41

net: phy: Remove LED entry from LEDs list on unregister

2024-10-08 CVE-2024-50023

mediumMicrosoft MSRC 2024-W41

net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition

2024-10-08 CVE-2024-47747

highMicrosoft MSRC 2024-W41

net: stmmac: Fix zero-division error when disabling tc cbs

2024-10-08 CVE-2024-49977

mediumMicrosoft MSRC 2024-W41

net/ncsi: Disable the ncsi work before freeing the associated structure

2024-10-08 CVE-2024-49945

mediumMicrosoft MSRC 2024-W41

netfilter: flowtable_offload: fix using __this_cpu_add in preemptible

2024-10-08 CVE-2022-48976

mediumMicrosoft MSRC 2024-W41

netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()

2024-10-08 CVE-2024-47685

criticalMicrosoft MSRC 2024-W41

netfilter: nf_tables: prevent nf_skb_duplicated corruption

2024-10-08 CVE-2024-49952

mediumMicrosoft MSRC 2024-W41

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-08 CVE-2024-50038

mediumMicrosoft MSRC 2024-W41

nfsd: call cache_put if xdr_reserve_space returns NULL

2024-10-08 CVE-2024-47737

mediumMicrosoft MSRC 2024-W41

NFSD: Limit the number of concurrent async COPY operations

2024-10-08 CVE-2024-49974

mediumMicrosoft MSRC 2024-W41

nfsd: return -EINVAL when namelen is 0

2024-10-08 CVE-2024-47692

mediumMicrosoft MSRC 2024-W41

nilfs2: fix potential oob read in nilfs_btree_check_delete()

2024-10-08 CVE-2024-47757

highMicrosoft MSRC 2024-W41

NT OS Kernel Elevation of Privilege Vulnerability

2024-10-08 CVE-2024-43553

highMicrosoft MSRC 2024-W41

ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()

2024-10-08 CVE-2023-52917

mediumMicrosoft MSRC 2024-W41

NVIDIA: CVE-2024-0132 Container Toolkit 1.16.1 and Earlier Time-of-check Time-of Use Vulnerability

2024-10-08 CVE-2024-0132

highMicrosoft MSRC 2024-W41

ocfs2: add bounds checking to ocfs2_xattr_find_entry()

2024-10-08 CVE-2024-47670

highMicrosoft MSRC 2024-W41

OpenIPMI before 2.0.36 has an out-of-bounds array access (for authentication type) in the ipmi_sim simulator resulting in denial of service or (with very low probability) authentic

2024-10-08 CVE-2024-42934

mediumMicrosoft MSRC 2024-W41

Outlook for Android Elevation of Privilege Vulnerability

2024-10-08 CVE-2024-43604

mediumMicrosoft MSRC 2024-W41

pam_oath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because in the context of PAM code running as root it mishandles usersfile access su

2024-10-08 CVE-2024-47191

highMicrosoft MSRC 2024-W41

Pam: libpam: libpam vulnerable to read hashed password

2024-10-08 CVE-2024-10041

mediumMicrosoft MSRC 2024-W41

PCI: keystone: Fix if-statement expression in ks_pcie_quirk()

2024-10-08 CVE-2024-47756

mediumMicrosoft MSRC 2024-W41

PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)

2024-10-08 CVE-2024-8926

highMicrosoft MSRC 2024-W41

PHP-FPM logs from children may be altered

2024-10-08 CVE-2024-9026

lowMicrosoft MSRC 2024-W41

pinctrl: stm32: check devm_kasprintf() returned value

2024-10-08 CVE-2024-50070

mediumMicrosoft MSRC 2024-W41

Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library

2024-10-08 CVE-2024-9341

mediumMicrosoft MSRC 2024-W41

Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)

2024-10-08 CVE-2024-9676

mediumMicrosoft MSRC 2024-W41

Power BI Report Server Spoofing Vulnerability

2024-10-08 CVE-2024-43481

mediumMicrosoft MSRC 2024-W41

Power BI Report Server Spoofing Vulnerability

2024-10-08 CVE-2024-43612

mediumMicrosoft MSRC 2024-W41

powercap: intel_rapl: Fix off by one in get_rpi()

2024-10-08 CVE-2024-49862

highMicrosoft MSRC 2024-W41

ppp: do not assume bh is held in ppp_channel_bridge_input()

2024-10-08 CVE-2024-49946

mediumMicrosoft MSRC 2024-W41

Qualcomm Multiple Chipsets Use-After-Free Vulnerability

2024-10-08 CVE-2024-43047

highQualcomm CVE 2024-W41

QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list

2024-10-08 CVE-2024-49214

mediumMicrosoft MSRC 2024-W41

rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb()

2024-10-08 CVE-2024-49926

mediumMicrosoft MSRC 2024-W41