ISHACK AI BOT

Microsoft CVE-2024-28943: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 04/09/2024 Created 04/10/2024 Added 04/09/2024 Modified 04/11/2024 Description Microsoft CVE-2024-28943: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Solution(s) msft-kb5035432-d97a1fcd-d0c8-40c3-9210-2d011a735734-x64 msft-kb5035434-2cd70150-9029-45c6-988e-1c461fbbf569-x64 msft-kb5036335-2e46842c-5d02-40bd-9d51-6b402081d64d-x64 msft-kb5036343-fc6968a8-4ca4-4135-b692-8ef1d5dc57dc-x64 References https://attackerkb.com/topics/cve-2024-28943 CVE - 2024-28943 5035432 5035434 5036335 5036343 5037570 5037571 View more

Microsoft CVE-2024-28934: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 04/09/2024 Created 04/10/2024 Added 04/09/2024 Modified 04/11/2024 Description Microsoft CVE-2024-28934: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Solution(s) msft-kb5035432-d97a1fcd-d0c8-40c3-9210-2d011a735734-x64 msft-kb5035434-2cd70150-9029-45c6-988e-1c461fbbf569-x64 msft-kb5036335-2e46842c-5d02-40bd-9d51-6b402081d64d-x64 msft-kb5036343-fc6968a8-4ca4-4135-b692-8ef1d5dc57dc-x64 References https://attackerkb.com/topics/cve-2024-28934 CVE - 2024-28934 5035432 5035434 5036335 5036343 5037570 5037571 View more

Foxit Reader: Out-of-Bounds Read/Write vulnerability (CVE-2024-30361) Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 04/09/2024 Created 04/16/2024 Added 04/09/2024 Modified 04/17/2024 Description Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22877. Solution(s) foxit-reader-upgrade-latest References https://attackerkb.com/topics/cve-2024-30361 CVE - 2024-30361 https://www.foxit.com/support/security-bulletins.html https://www.zerodayinitiative.com/advisories/ZDI-24-338/

Microsoft Office: CVE-2024-26257: Microsoft Excel Remote Code Execution Vulnerability Severity 4 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 04/09/2024 Created 04/10/2024 Added 04/09/2024 Modified 09/10/2024 Description Microsoft Excel Remote Code Execution Vulnerability Solution(s) office-click-to-run-upgrade-latest References https://attackerkb.com/topics/cve-2024-26257 CVE - 2024-26257

Microsoft Windows: CVE-2024-26195: DHCP Server Service Remote Code Execution Vulnerability Severity 8 CVSS (AV:N/AC:L/Au:M/C:C/I:C/A:C) Published 04/09/2024 Created 04/10/2024 Added 04/09/2024 Modified 09/06/2024 Description DHCP Server Service Remote Code Execution Vulnerability Solution(s) microsoft-windows-windows_server_2012-kb5036969 microsoft-windows-windows_server_2012_r2-kb5036960 microsoft-windows-windows_server_2016-1607-kb5036899 microsoft-windows-windows_server_2019-1809-kb5036896 microsoft-windows-windows_server_2022-21h2-kb5036909 microsoft-windows-windows_server_2022-22h2-kb5036909 microsoft-windows-windows_server_2022-23h2-kb5036910 msft-kb5036922-1b6c2afa-24b1-40e8-bc07-9cb3aaf3e493 References https://attackerkb.com/topics/cve-2024-26195 CVE - 2024-26195 https://support.microsoft.com/help/5036896 https://support.microsoft.com/help/5036899 https://support.microsoft.com/help/5036909 https://support.microsoft.com/help/5036910 https://support.microsoft.com/help/5036960 https://support.microsoft.com/help/5036969 View more

Microsoft Windows: CVE-2024-26239: Windows Telephony Server Elevation of Privilege Vulnerability Severity 7 CVSS (AV:L/AC:L/Au:S/C:C/I:C/A:C) Published 04/09/2024 Created 04/10/2024 Added 04/09/2024 Modified 09/05/2024 Description Windows Telephony Server Elevation of Privilege Vulnerability Solution(s) microsoft-windows-windows_10-1507-kb5036925 microsoft-windows-windows_10-1607-kb5036899 microsoft-windows-windows_10-1809-kb5036896 microsoft-windows-windows_10-21h2-kb5036892 microsoft-windows-windows_10-22h2-kb5036892 microsoft-windows-windows_11-21h2-kb5036894 microsoft-windows-windows_11-22h2-kb5036893 microsoft-windows-windows_11-23h2-kb5036893 microsoft-windows-windows_server_2012_r2-kb5036960 microsoft-windows-windows_server_2016-1607-kb5036899 microsoft-windows-windows_server_2019-1809-kb5036896 microsoft-windows-windows_server_2022-21h2-kb5036909 microsoft-windows-windows_server_2022-22h2-kb5036909 microsoft-windows-windows_server_2022-23h2-kb5036910 References https://attackerkb.com/topics/cve-2024-26239 CVE - 2024-26239 https://support.microsoft.com/help/5036892 https://support.microsoft.com/help/5036893 https://support.microsoft.com/help/5036894 https://support.microsoft.com/help/5036896 https://support.microsoft.com/help/5036899 https://support.microsoft.com/help/5036909 https://support.microsoft.com/help/5036910 https://support.microsoft.com/help/5036925 https://support.microsoft.com/help/5036960 View more

Microsoft CVE-2024-28908: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 04/09/2024 Created 04/10/2024 Added 04/09/2024 Modified 04/11/2024 Description Microsoft CVE-2024-28908: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability Solution(s) msft-kb5035432-d97a1fcd-d0c8-40c3-9210-2d011a735734-x64 msft-kb5035434-2cd70150-9029-45c6-988e-1c461fbbf569-x64 msft-kb5036335-2e46842c-5d02-40bd-9d51-6b402081d64d-x64 msft-kb5036343-fc6968a8-4ca4-4135-b692-8ef1d5dc57dc-x64 References https://attackerkb.com/topics/cve-2024-28908 CVE - 2024-28908 5035432 5035434 5036335 5036343 5037572 5037573 View more

Microsoft Windows: CVE-2024-28924: Secure Boot Security Feature Bypass Vulnerability Severity 7 CVSS (AV:L/AC:L/Au:M/C:C/I:C/A:C) Published 04/09/2024 Created 04/10/2024 Added 04/09/2024 Modified 09/06/2024 Description Secure Boot Security Feature Bypass Vulnerability Solution(s) microsoft-windows-windows_10-1507-kb5036925 microsoft-windows-windows_10-1607-kb5036899 microsoft-windows-windows_10-1809-kb5036896 microsoft-windows-windows_10-21h2-kb5036892 microsoft-windows-windows_10-22h2-kb5036892 microsoft-windows-windows_11-21h2-kb5036894 microsoft-windows-windows_11-22h2-kb5036893 microsoft-windows-windows_11-23h2-kb5036893 microsoft-windows-windows_server_2012-kb5036969 microsoft-windows-windows_server_2012_r2-kb5036960 microsoft-windows-windows_server_2016-1607-kb5036899 microsoft-windows-windows_server_2019-1809-kb5036896 microsoft-windows-windows_server_2022-21h2-kb5036909 microsoft-windows-windows_server_2022-22h2-kb5036909 microsoft-windows-windows_server_2022-23h2-kb5036910 References https://attackerkb.com/topics/cve-2024-28924 CVE - 2024-28924 https://support.microsoft.com/help/5036892 https://support.microsoft.com/help/5036893 https://support.microsoft.com/help/5036894 https://support.microsoft.com/help/5036896 https://support.microsoft.com/help/5036899 https://support.microsoft.com/help/5036909 https://support.microsoft.com/help/5036910 https://support.microsoft.com/help/5036925 https://support.microsoft.com/help/5036960 https://support.microsoft.com/help/5036969 View more

Microsoft CVE-2024-28906: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 04/09/2024 Created 04/10/2024 Added 04/09/2024 Modified 04/11/2024 Description Microsoft CVE-2024-28906: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability Solution(s) msft-kb5035432-d97a1fcd-d0c8-40c3-9210-2d011a735734-x64 msft-kb5035434-2cd70150-9029-45c6-988e-1c461fbbf569-x64 msft-kb5036335-2e46842c-5d02-40bd-9d51-6b402081d64d-x64 msft-kb5036343-fc6968a8-4ca4-4135-b692-8ef1d5dc57dc-x64 References https://attackerkb.com/topics/cve-2024-28906 CVE - 2024-28906 5035432 5035434 5036335 5036343 5037572 5037573 View more

Microsoft Windows: CVE-2024-26189: Secure Boot Security Feature Bypass Vulnerability Severity 8 CVSS (AV:A/AC:M/Au:N/C:C/I:C/A:C) Published 04/09/2024 Created 04/10/2024 Added 04/09/2024 Modified 09/06/2024 Description Secure Boot Security Feature Bypass Vulnerability Solution(s) microsoft-windows-windows_10-1507-kb5036925 microsoft-windows-windows_10-1607-kb5036899 microsoft-windows-windows_10-1809-kb5036896 microsoft-windows-windows_10-21h2-kb5036892 microsoft-windows-windows_10-22h2-kb5036892 microsoft-windows-windows_11-21h2-kb5036894 microsoft-windows-windows_11-22h2-kb5036893 microsoft-windows-windows_11-23h2-kb5036893 microsoft-windows-windows_server_2012-kb5036969 microsoft-windows-windows_server_2012_r2-kb5036960 microsoft-windows-windows_server_2016-1607-kb5036899 microsoft-windows-windows_server_2019-1809-kb5036896 microsoft-windows-windows_server_2022-21h2-kb5036909 microsoft-windows-windows_server_2022-22h2-kb5036909 microsoft-windows-windows_server_2022-23h2-kb5036910 References https://attackerkb.com/topics/cve-2024-26189 CVE - 2024-26189 https://support.microsoft.com/help/5036892 https://support.microsoft.com/help/5036893 https://support.microsoft.com/help/5036894 https://support.microsoft.com/help/5036896 https://support.microsoft.com/help/5036899 https://support.microsoft.com/help/5036909 https://support.microsoft.com/help/5036910 https://support.microsoft.com/help/5036925 https://support.microsoft.com/help/5036960 https://support.microsoft.com/help/5036969 View more

Microsoft Windows: CVE-2024-29052: Windows Storage Elevation of Privilege Vulnerability Severity 7 CVSS (AV:L/AC:L/Au:S/C:C/I:C/A:C) Published 04/09/2024 Created 04/10/2024 Added 04/09/2024 Modified 08/13/2024 Description Windows Storage Elevation of Privilege Vulnerability Solution(s) microsoft-windows-windows_10-21h2-kb5036892 microsoft-windows-windows_10-22h2-kb5036892 microsoft-windows-windows_11-21h2-kb5036894 microsoft-windows-windows_11-22h2-kb5036893 microsoft-windows-windows_11-23h2-kb5036893 microsoft-windows-windows_server_2022-21h2-kb5036909 microsoft-windows-windows_server_2022-22h2-kb5036909 microsoft-windows-windows_server_2022-23h2-kb5036910 References https://attackerkb.com/topics/cve-2024-29052 CVE - 2024-29052 https://support.microsoft.com/help/5036892 https://support.microsoft.com/help/5036893 https://support.microsoft.com/help/5036894 https://support.microsoft.com/help/5036909 https://support.microsoft.com/help/5036910

Microsoft Windows: CVE-2024-28919: Secure Boot Security Feature Bypass Vulnerability Severity 7 CVSS (AV:L/AC:L/Au:M/C:C/I:C/A:C) Published 04/09/2024 Created 04/10/2024 Added 04/09/2024 Modified 09/06/2024 Description Secure Boot Security Feature Bypass Vulnerability Solution(s) microsoft-windows-windows_10-1507-kb5036925 microsoft-windows-windows_10-1607-kb5036899 microsoft-windows-windows_10-1809-kb5036896 microsoft-windows-windows_10-21h2-kb5036892 microsoft-windows-windows_10-22h2-kb5036892 microsoft-windows-windows_11-21h2-kb5036894 microsoft-windows-windows_11-22h2-kb5036893 microsoft-windows-windows_11-23h2-kb5036893 microsoft-windows-windows_server_2012-kb5036969 microsoft-windows-windows_server_2012_r2-kb5036960 microsoft-windows-windows_server_2016-1607-kb5036899 microsoft-windows-windows_server_2019-1809-kb5036896 microsoft-windows-windows_server_2022-21h2-kb5036909 microsoft-windows-windows_server_2022-22h2-kb5036909 microsoft-windows-windows_server_2022-23h2-kb5036910 References https://attackerkb.com/topics/cve-2024-28919 CVE - 2024-28919 https://support.microsoft.com/help/5036892 https://support.microsoft.com/help/5036893 https://support.microsoft.com/help/5036894 https://support.microsoft.com/help/5036896 https://support.microsoft.com/help/5036899 https://support.microsoft.com/help/5036909 https://support.microsoft.com/help/5036910 https://support.microsoft.com/help/5036925 https://support.microsoft.com/help/5036960 https://support.microsoft.com/help/5036969 View more

Microsoft Windows: CVE-2024-26183: Windows Kerberos Denial of Service Vulnerability Severity 7 CVSS (AV:N/AC:L/Au:S/C:N/I:N/A:C) Published 04/09/2024 Created 04/10/2024 Added 04/09/2024 Modified 09/06/2024 Description Windows Kerberos Denial of Service Vulnerability Solution(s) microsoft-windows-windows_10-1507-kb5036925 microsoft-windows-windows_10-1607-kb5036899 microsoft-windows-windows_10-1809-kb5036896 microsoft-windows-windows_10-21h2-kb5036892 microsoft-windows-windows_10-22h2-kb5036892 microsoft-windows-windows_11-21h2-kb5036894 microsoft-windows-windows_11-22h2-kb5036893 microsoft-windows-windows_11-23h2-kb5036893 microsoft-windows-windows_server_2012-kb5036969 microsoft-windows-windows_server_2012_r2-kb5036960 microsoft-windows-windows_server_2016-1607-kb5036899 microsoft-windows-windows_server_2019-1809-kb5036896 microsoft-windows-windows_server_2022-21h2-kb5036909 microsoft-windows-windows_server_2022-22h2-kb5036909 msft-kb5036922-1b6c2afa-24b1-40e8-bc07-9cb3aaf3e493 msft-kb5036950-1619240b-73e4-49a5-9412-39489e0e1cb4 msft-kb5036950-aeb7362d-f252-4046-a3e1-7ead5d01e242 References https://attackerkb.com/topics/cve-2024-26183 CVE - 2024-26183 https://support.microsoft.com/help/5036892 https://support.microsoft.com/help/5036893 https://support.microsoft.com/help/5036894 https://support.microsoft.com/help/5036896 https://support.microsoft.com/help/5036899 https://support.microsoft.com/help/5036909 https://support.microsoft.com/help/5036925 https://support.microsoft.com/help/5036960 https://support.microsoft.com/help/5036969 View more

Microsoft Windows: CVE-2024-26243: Windows USB Print Driver Elevation of Privilege Vulnerability Severity 7 CVSS (AV:L/AC:M/Au:S/C:C/I:C/A:C) Published 04/09/2024 Created 04/10/2024 Added 04/09/2024 Modified 08/13/2024 Description Windows USB Print Driver Elevation of Privilege Vulnerability Solution(s) microsoft-windows-windows_10-21h2-kb5036892 microsoft-windows-windows_10-22h2-kb5036892 microsoft-windows-windows_11-21h2-kb5036894 microsoft-windows-windows_11-22h2-kb5036893 microsoft-windows-windows_11-23h2-kb5036893 microsoft-windows-windows_server_2022-21h2-kb5036909 microsoft-windows-windows_server_2022-22h2-kb5036909 microsoft-windows-windows_server_2022-23h2-kb5036910 References https://attackerkb.com/topics/cve-2024-26243 CVE - 2024-26243 https://support.microsoft.com/help/5036892 https://support.microsoft.com/help/5036893 https://support.microsoft.com/help/5036894 https://support.microsoft.com/help/5036909 https://support.microsoft.com/help/5036910

VMware Photon OS: CVE-2021-47189 Severity 7 CVSS (AV:N/AC:L/Au:S/C:P/I:P/A:P) Published 04/10/2024 Created 01/21/2025 Added 01/20/2025 Modified 02/04/2025 Description In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory ordering between normal and ordered work functions Ordered work functions aren't guaranteed to be handled by the same thread which executed the normal work functions. The only way execution between normal/ordered functions is synchronized is via the WORK_DONE_BIT, unfortunately the used bitops don't guarantee any ordering whatsoever. This manifested as seemingly inexplicable crashes on ARM64, where async_chunk::inode is seen as non-null in async_cow_submit which causes submit_compressed_extents to be called and crash occurs because async_chunk::inode suddenly became NULL. The call trace was similar to: pc : submit_compressed_extents+0x38/0x3d0 lr : async_cow_submit+0x50/0xd0 sp : ffff800015d4bc20 <registers omitted for brevity> Call trace: submit_compressed_extents+0x38/0x3d0 async_cow_submit+0x50/0xd0 run_ordered_work+0xc8/0x280 btrfs_work_helper+0x98/0x250 process_one_work+0x1f0/0x4ac worker_thread+0x188/0x504 kthread+0x110/0x114 ret_from_fork+0x10/0x18 Fix this by adding respective barrier calls which ensure that all accesses preceding setting of WORK_DONE_BIT are strictly ordered before setting the flag. At the same time add a read barrier after reading of WORK_DONE_BIT in run_ordered_work which ensures all subsequent loads would be strictly ordered after reading the bit. This in turn ensures are all accesses before WORK_DONE_BIT are going to be strictly ordered before any access that can occur in ordered_func. Solution(s) vmware-photon_os_update_tdnf References https://attackerkb.com/topics/cve-2021-47189 CVE - 2021-47189

VMware Photon OS: CVE-2021-47203 Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 04/10/2024 Created 01/21/2025 Added 01/20/2025 Modified 01/20/2025 Description In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() When parsing the txq list in lpfc_drain_txq(), the driver attempts to pass the requests to the adapter. If such an attempt fails, a local "fail_msg" string is set and a log message output.The job is then added to a completions list for cancellation. Processing of any further jobs from the txq list continues, but since "fail_msg" remains set, jobs are added to the completions list regardless of whether a wqe was passed to the adapter.If successfully added to txcmplq, jobs are added to both lists resulting in list corruption. Fix by clearing the fail_msg string after adding a job to the completions list. This stops the subsequent jobs from being added to the completions list unless they had an appropriate failure. Solution(s) vmware-photon_os_update_tdnf References https://attackerkb.com/topics/cve-2021-47203 CVE - 2021-47203

VMware Photon OS: CVE-2024-26816 Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 04/10/2024 Created 01/21/2025 Added 01/20/2025 Modified 01/20/2025 Description In the Linux kernel, the following vulnerability has been resolved: x86, relocs: Ignore relocations in .notes section When building with CONFIG_XEN_PV=y, .text symbols are emitted into the .notes section so that Xen can find the "startup_xen" entry point. This information is used prior to booting the kernel, so relocations are not useful. In fact, performing relocations against the .notes section means that the KASLR base is exposed since /sys/kernel/notes is world-readable. To avoid leaking the KASLR base without breaking unprivileged tools that are expecting to read /sys/kernel/notes, skip performing relocations in the .notes section. The values readable in .notes are then identical to those found in System.map. Solution(s) vmware-photon_os_update_tdnf References https://attackerkb.com/topics/cve-2024-26816 CVE - 2024-26816

SUSE: CVE-2021-47195: SUSE Linux Security Advisory Severity 5 CVSS (AV:L/AC:L/Au:S/C:N/I:N/A:C) Published 04/10/2024 Created 08/16/2024 Added 08/09/2024 Modified 01/28/2025 Description In the Linux kernel, the following vulnerability has been resolved: spi: fix use-after-free of the add_lock mutex Commit 6098475d4cb4 ("spi: Fix deadlock when adding SPI controllers on SPI buses") introduced a per-controller mutex. But mutex_unlock() of said lock is called after the controller is already freed: spi_unregister_controller(ctlr) -> put_device(&ctlr->dev) -> spi_controller_release(dev) -> mutex_unlock(&ctrl->add_lock) Move the put_device() after the mutex_unlock(). Solution(s) suse-upgrade-cluster-md-kmp-64kb suse-upgrade-cluster-md-kmp-azure suse-upgrade-cluster-md-kmp-default suse-upgrade-cluster-md-kmp-rt suse-upgrade-dlm-kmp-64kb suse-upgrade-dlm-kmp-azure suse-upgrade-dlm-kmp-default suse-upgrade-dlm-kmp-rt suse-upgrade-dtb-allwinner suse-upgrade-dtb-altera suse-upgrade-dtb-amazon suse-upgrade-dtb-amd suse-upgrade-dtb-amlogic suse-upgrade-dtb-apm suse-upgrade-dtb-apple suse-upgrade-dtb-arm suse-upgrade-dtb-broadcom suse-upgrade-dtb-cavium suse-upgrade-dtb-exynos suse-upgrade-dtb-freescale suse-upgrade-dtb-hisilicon suse-upgrade-dtb-lg suse-upgrade-dtb-marvell suse-upgrade-dtb-mediatek suse-upgrade-dtb-nvidia suse-upgrade-dtb-qcom suse-upgrade-dtb-renesas suse-upgrade-dtb-rockchip suse-upgrade-dtb-socionext suse-upgrade-dtb-sprd suse-upgrade-dtb-xilinx suse-upgrade-gfs2-kmp-64kb suse-upgrade-gfs2-kmp-azure suse-upgrade-gfs2-kmp-default suse-upgrade-gfs2-kmp-rt suse-upgrade-kernel-64kb suse-upgrade-kernel-64kb-devel suse-upgrade-kernel-64kb-extra suse-upgrade-kernel-64kb-livepatch-devel suse-upgrade-kernel-64kb-optional suse-upgrade-kernel-azure suse-upgrade-kernel-azure-devel suse-upgrade-kernel-azure-extra suse-upgrade-kernel-azure-livepatch-devel suse-upgrade-kernel-azure-optional suse-upgrade-kernel-azure-vdso suse-upgrade-kernel-debug suse-upgrade-kernel-debug-devel suse-upgrade-kernel-debug-livepatch-devel suse-upgrade-kernel-debug-vdso suse-upgrade-kernel-default suse-upgrade-kernel-default-base suse-upgrade-kernel-default-base-rebuild suse-upgrade-kernel-default-devel suse-upgrade-kernel-default-extra suse-upgrade-kernel-default-livepatch suse-upgrade-kernel-default-livepatch-devel suse-upgrade-kernel-default-optional suse-upgrade-kernel-default-vdso suse-upgrade-kernel-devel suse-upgrade-kernel-devel-azure suse-upgrade-kernel-devel-rt suse-upgrade-kernel-docs suse-upgrade-kernel-docs-html suse-upgrade-kernel-kvmsmall suse-upgrade-kernel-kvmsmall-devel suse-upgrade-kernel-kvmsmall-livepatch-devel suse-upgrade-kernel-kvmsmall-vdso suse-upgrade-kernel-macros suse-upgrade-kernel-obs-build suse-upgrade-kernel-obs-qa suse-upgrade-kernel-rt suse-upgrade-kernel-rt-devel suse-upgrade-kernel-rt-extra suse-upgrade-kernel-rt-livepatch suse-upgrade-kernel-rt-livepatch-devel suse-upgrade-kernel-rt-optional suse-upgrade-kernel-rt-vdso suse-upgrade-kernel-rt_debug suse-upgrade-kernel-rt_debug-devel suse-upgrade-kernel-rt_debug-livepatch-devel suse-upgrade-kernel-rt_debug-vdso suse-upgrade-kernel-source suse-upgrade-kernel-source-azure suse-upgrade-kernel-source-rt suse-upgrade-kernel-source-vanilla suse-upgrade-kernel-syms suse-upgrade-kernel-syms-azure suse-upgrade-kernel-syms-rt suse-upgrade-kernel-zfcpdump suse-upgrade-kselftests-kmp-64kb suse-upgrade-kselftests-kmp-azure suse-upgrade-kselftests-kmp-default suse-upgrade-kselftests-kmp-rt suse-upgrade-ocfs2-kmp-64kb suse-upgrade-ocfs2-kmp-azure suse-upgrade-ocfs2-kmp-default suse-upgrade-ocfs2-kmp-rt suse-upgrade-reiserfs-kmp-64kb suse-upgrade-reiserfs-kmp-azure suse-upgrade-reiserfs-kmp-default suse-upgrade-reiserfs-kmp-rt References https://attackerkb.com/topics/cve-2021-47195 CVE - 2021-47195

Microsoft CVE-2024-28931: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 04/09/2024 Created 04/10/2024 Added 04/09/2024 Modified 04/11/2024 Description Microsoft CVE-2024-28931: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Solution(s) msft-kb5035432-d97a1fcd-d0c8-40c3-9210-2d011a735734-x64 msft-kb5035434-2cd70150-9029-45c6-988e-1c461fbbf569-x64 msft-kb5036335-2e46842c-5d02-40bd-9d51-6b402081d64d-x64 msft-kb5036343-fc6968a8-4ca4-4135-b692-8ef1d5dc57dc-x64 References https://attackerkb.com/topics/cve-2024-28931 CVE - 2024-28931 5035432 5035434 5036335 5036343 5037570 5037571 View more

SUSE: CVE-2021-47192: SUSE Linux Security Advisory Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 04/10/2024 Created 08/16/2024 Added 08/09/2024 Modified 08/09/2024 Description In the Linux kernel, the following vulnerability has been resolved: scsi: core: sysfs: Fix hang when device state is set via sysfs This fixes a regression added with: commit f0f82e2476f6 ("scsi: core: Fix capacity set to zero after offlinining device") The problem is that after iSCSI recovery, iscsid will call into the kernel to set the dev's state to running, and with that patch we now call scsi_rescan_device() with the state_mutex held. If the SCSI error handler thread is just starting to test the device in scsi_send_eh_cmnd() then it's going to try to grab the state_mutex. We are then stuck, because when scsi_rescan_device() tries to send its I/O scsi_queue_rq() calls -> scsi_host_queue_ready() -> scsi_host_in_recovery() which will return true (the host state is still in recovery) and I/O will just be requeued. scsi_send_eh_cmnd() will then never be able to grab the state_mutex to finish error handling. To prevent the deadlock move the rescan-related code to after we drop the state_mutex. This also adds a check for if we are already in the running state. This prevents extra scans and helps the iscsid case where if the transport class has already onlined the device during its recovery process then we don't need userspace to do it again plus possibly block that daemon. Solution(s) suse-upgrade-cluster-md-kmp-64kb suse-upgrade-cluster-md-kmp-azure suse-upgrade-cluster-md-kmp-default suse-upgrade-cluster-md-kmp-rt suse-upgrade-dlm-kmp-64kb suse-upgrade-dlm-kmp-azure suse-upgrade-dlm-kmp-default suse-upgrade-dlm-kmp-rt suse-upgrade-dtb-allwinner suse-upgrade-dtb-altera suse-upgrade-dtb-amazon suse-upgrade-dtb-amd suse-upgrade-dtb-amlogic suse-upgrade-dtb-apm suse-upgrade-dtb-apple suse-upgrade-dtb-arm suse-upgrade-dtb-broadcom suse-upgrade-dtb-cavium suse-upgrade-dtb-exynos suse-upgrade-dtb-freescale suse-upgrade-dtb-hisilicon suse-upgrade-dtb-lg suse-upgrade-dtb-marvell suse-upgrade-dtb-mediatek suse-upgrade-dtb-nvidia suse-upgrade-dtb-qcom suse-upgrade-dtb-renesas suse-upgrade-dtb-rockchip suse-upgrade-dtb-socionext suse-upgrade-dtb-sprd suse-upgrade-dtb-xilinx suse-upgrade-gfs2-kmp-64kb suse-upgrade-gfs2-kmp-azure suse-upgrade-gfs2-kmp-default suse-upgrade-gfs2-kmp-rt suse-upgrade-kernel-64kb suse-upgrade-kernel-64kb-devel suse-upgrade-kernel-64kb-extra suse-upgrade-kernel-64kb-livepatch-devel suse-upgrade-kernel-64kb-optional suse-upgrade-kernel-azure suse-upgrade-kernel-azure-devel suse-upgrade-kernel-azure-extra suse-upgrade-kernel-azure-livepatch-devel suse-upgrade-kernel-azure-optional suse-upgrade-kernel-azure-vdso suse-upgrade-kernel-debug suse-upgrade-kernel-debug-devel suse-upgrade-kernel-debug-livepatch-devel suse-upgrade-kernel-debug-vdso suse-upgrade-kernel-default suse-upgrade-kernel-default-base suse-upgrade-kernel-default-base-rebuild suse-upgrade-kernel-default-devel suse-upgrade-kernel-default-extra suse-upgrade-kernel-default-livepatch suse-upgrade-kernel-default-livepatch-devel suse-upgrade-kernel-default-optional suse-upgrade-kernel-default-vdso suse-upgrade-kernel-devel suse-upgrade-kernel-devel-azure suse-upgrade-kernel-devel-rt suse-upgrade-kernel-docs suse-upgrade-kernel-docs-html suse-upgrade-kernel-kvmsmall suse-upgrade-kernel-kvmsmall-devel suse-upgrade-kernel-kvmsmall-livepatch-devel suse-upgrade-kernel-kvmsmall-vdso suse-upgrade-kernel-macros suse-upgrade-kernel-obs-build suse-upgrade-kernel-obs-qa suse-upgrade-kernel-preempt suse-upgrade-kernel-preempt-devel suse-upgrade-kernel-rt suse-upgrade-kernel-rt-devel suse-upgrade-kernel-rt-extra suse-upgrade-kernel-rt-livepatch suse-upgrade-kernel-rt-livepatch-devel suse-upgrade-kernel-rt-optional suse-upgrade-kernel-rt-vdso suse-upgrade-kernel-rt_debug suse-upgrade-kernel-rt_debug-devel suse-upgrade-kernel-rt_debug-livepatch-devel suse-upgrade-kernel-rt_debug-vdso suse-upgrade-kernel-source suse-upgrade-kernel-source-azure suse-upgrade-kernel-source-rt suse-upgrade-kernel-source-vanilla suse-upgrade-kernel-syms suse-upgrade-kernel-syms-azure suse-upgrade-kernel-syms-rt suse-upgrade-kernel-zfcpdump suse-upgrade-kselftests-kmp-64kb suse-upgrade-kselftests-kmp-azure suse-upgrade-kselftests-kmp-default suse-upgrade-kselftests-kmp-rt suse-upgrade-ocfs2-kmp-64kb suse-upgrade-ocfs2-kmp-azure suse-upgrade-ocfs2-kmp-default suse-upgrade-ocfs2-kmp-rt suse-upgrade-reiserfs-kmp-64kb suse-upgrade-reiserfs-kmp-azure suse-upgrade-reiserfs-kmp-default suse-upgrade-reiserfs-kmp-rt References https://attackerkb.com/topics/cve-2021-47192 CVE - 2021-47192

Microsoft CVE-2024-28930: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 04/09/2024 Created 04/10/2024 Added 04/09/2024 Modified 04/11/2024 Description Microsoft CVE-2024-28930: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Solution(s) msft-kb5035432-d97a1fcd-d0c8-40c3-9210-2d011a735734-x64 msft-kb5035434-2cd70150-9029-45c6-988e-1c461fbbf569-x64 msft-kb5036335-2e46842c-5d02-40bd-9d51-6b402081d64d-x64 msft-kb5036343-fc6968a8-4ca4-4135-b692-8ef1d5dc57dc-x64 References https://attackerkb.com/topics/cve-2024-28930 CVE - 2024-28930 5035432 5035434 5036335 5036343 5037570 5037571 View more

Microsoft CVE-2024-28945: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 04/09/2024 Created 04/10/2024 Added 04/09/2024 Modified 04/11/2024 Description Microsoft CVE-2024-28945: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability Solution(s) msft-kb5035432-d97a1fcd-d0c8-40c3-9210-2d011a735734-x64 msft-kb5035434-2cd70150-9029-45c6-988e-1c461fbbf569-x64 msft-kb5036335-2e46842c-5d02-40bd-9d51-6b402081d64d-x64 msft-kb5036343-fc6968a8-4ca4-4135-b692-8ef1d5dc57dc-x64 References https://attackerkb.com/topics/cve-2024-28945 CVE - 2024-28945 5035432 5035434 5036335 5036343 5037572 5037573 View more

Microsoft CVE-2024-28935: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 04/09/2024 Created 04/10/2024 Added 04/09/2024 Modified 04/11/2024 Description Microsoft CVE-2024-28935: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Solution(s) msft-kb5035432-d97a1fcd-d0c8-40c3-9210-2d011a735734-x64 msft-kb5035434-2cd70150-9029-45c6-988e-1c461fbbf569-x64 msft-kb5036335-2e46842c-5d02-40bd-9d51-6b402081d64d-x64 msft-kb5036343-fc6968a8-4ca4-4135-b692-8ef1d5dc57dc-x64 References https://attackerkb.com/topics/cve-2024-28935 CVE - 2024-28935 5035432 5035434 5036335 5036343 5037570 5037571 View more

Microsoft Windows: CVE-2024-20669: Secure Boot Security Feature Bypass Vulnerability Severity 7 CVSS (AV:L/AC:L/Au:M/C:C/I:C/A:C) Published 04/09/2024 Created 04/10/2024 Added 04/09/2024 Modified 09/06/2024 Description Secure Boot Security Feature Bypass Vulnerability Solution(s) microsoft-windows-windows_10-1507-kb5036925 microsoft-windows-windows_10-1607-kb5036899 microsoft-windows-windows_10-1809-kb5036896 microsoft-windows-windows_10-21h2-kb5036892 microsoft-windows-windows_10-22h2-kb5036892 microsoft-windows-windows_11-21h2-kb5036894 microsoft-windows-windows_11-22h2-kb5036893 microsoft-windows-windows_11-23h2-kb5036893 microsoft-windows-windows_server_2012-kb5036969 microsoft-windows-windows_server_2012_r2-kb5036960 microsoft-windows-windows_server_2016-1607-kb5036899 microsoft-windows-windows_server_2019-1809-kb5036896 microsoft-windows-windows_server_2022-21h2-kb5036909 microsoft-windows-windows_server_2022-22h2-kb5036909 microsoft-windows-windows_server_2022-23h2-kb5036910 References https://attackerkb.com/topics/cve-2024-20669 CVE - 2024-20669 https://support.microsoft.com/help/5036892 https://support.microsoft.com/help/5036893 https://support.microsoft.com/help/5036894 https://support.microsoft.com/help/5036896 https://support.microsoft.com/help/5036899 https://support.microsoft.com/help/5036909 https://support.microsoft.com/help/5036910 https://support.microsoft.com/help/5036925 https://support.microsoft.com/help/5036960 https://support.microsoft.com/help/5036969 View more

Ubuntu: (Multiple Advisories) (CVE-2023-52340): Linux kernel vulnerabilities Severity 8 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:C) Published 04/09/2024 Created 04/10/2024 Added 04/10/2024 Modified 01/28/2025 Description The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold that can be consumed easily, e.g., leading to a denial of service (network is unreachable errors) when IPv6 packets are sent in a loop via a raw socket. Solution(s) ubuntu-upgrade-linux-image-5-15-0-102-generic ubuntu-upgrade-linux-image-5-15-0-102-generic-64k ubuntu-upgrade-linux-image-5-15-0-102-generic-lpae ubuntu-upgrade-linux-image-5-15-0-102-lowlatency ubuntu-upgrade-linux-image-5-15-0-102-lowlatency-64k ubuntu-upgrade-linux-image-5-15-0-1040-gkeop ubuntu-upgrade-linux-image-5-15-0-1048-nvidia ubuntu-upgrade-linux-image-5-15-0-1048-nvidia-lowlatency ubuntu-upgrade-linux-image-5-15-0-1050-ibm ubuntu-upgrade-linux-image-5-15-0-1050-raspi ubuntu-upgrade-linux-image-5-15-0-1052-intel-iotg ubuntu-upgrade-linux-image-5-15-0-1054-gke ubuntu-upgrade-linux-image-5-15-0-1054-kvm ubuntu-upgrade-linux-image-5-15-0-1055-gcp ubuntu-upgrade-linux-image-5-15-0-1055-oracle ubuntu-upgrade-linux-image-5-15-0-1057-aws ubuntu-upgrade-linux-image-5-15-0-1060-azure ubuntu-upgrade-linux-image-5-15-0-1060-azure-fde ubuntu-upgrade-linux-image-5-4-0-1034-iot ubuntu-upgrade-linux-image-5-4-0-1041-xilinx-zynqmp ubuntu-upgrade-linux-image-5-4-0-1069-ibm ubuntu-upgrade-linux-image-5-4-0-1082-bluefield ubuntu-upgrade-linux-image-5-4-0-1089-gkeop ubuntu-upgrade-linux-image-5-4-0-1106-raspi ubuntu-upgrade-linux-image-5-4-0-1110-kvm ubuntu-upgrade-linux-image-5-4-0-1121-oracle ubuntu-upgrade-linux-image-5-4-0-1122-aws ubuntu-upgrade-linux-image-5-4-0-1126-gcp ubuntu-upgrade-linux-image-5-4-0-1127-azure ubuntu-upgrade-linux-image-5-4-0-175-generic ubuntu-upgrade-linux-image-5-4-0-175-lowlatency ubuntu-upgrade-linux-image-5-4-0-176-generic ubuntu-upgrade-linux-image-5-4-0-176-generic-lpae ubuntu-upgrade-linux-image-5-4-0-176-lowlatency ubuntu-upgrade-linux-image-aws ubuntu-upgrade-linux-image-aws-lts-20-04 ubuntu-upgrade-linux-image-aws-lts-22-04 ubuntu-upgrade-linux-image-azure ubuntu-upgrade-linux-image-azure-cvm ubuntu-upgrade-linux-image-azure-fde ubuntu-upgrade-linux-image-azure-fde-lts-22-04 ubuntu-upgrade-linux-image-azure-lts-20-04 ubuntu-upgrade-linux-image-azure-lts-22-04 ubuntu-upgrade-linux-image-bluefield ubuntu-upgrade-linux-image-gcp ubuntu-upgrade-linux-image-gcp-lts-20-04 ubuntu-upgrade-linux-image-gcp-lts-22-04 ubuntu-upgrade-linux-image-generic ubuntu-upgrade-linux-image-generic-64k ubuntu-upgrade-linux-image-generic-64k-hwe-20-04 ubuntu-upgrade-linux-image-generic-hwe-18-04 ubuntu-upgrade-linux-image-generic-hwe-20-04 ubuntu-upgrade-linux-image-generic-lpae ubuntu-upgrade-linux-image-generic-lpae-hwe-20-04 ubuntu-upgrade-linux-image-gke ubuntu-upgrade-linux-image-gke-5-15 ubuntu-upgrade-linux-image-gkeop ubuntu-upgrade-linux-image-gkeop-5-15 ubuntu-upgrade-linux-image-gkeop-5-4 ubuntu-upgrade-linux-image-ibm ubuntu-upgrade-linux-image-ibm-lts-20-04 ubuntu-upgrade-linux-image-intel ubuntu-upgrade-linux-image-intel-iotg ubuntu-upgrade-linux-image-kvm ubuntu-upgrade-linux-image-lowlatency ubuntu-upgrade-linux-image-lowlatency-64k ubuntu-upgrade-linux-image-lowlatency-64k-hwe-20-04 ubuntu-upgrade-linux-image-lowlatency-hwe-18-04 ubuntu-upgrade-linux-image-lowlatency-hwe-20-04 ubuntu-upgrade-linux-image-nvidia ubuntu-upgrade-linux-image-nvidia-lowlatency ubuntu-upgrade-linux-image-oem ubuntu-upgrade-linux-image-oem-20-04 ubuntu-upgrade-linux-image-oem-20-04b ubuntu-upgrade-linux-image-oem-20-04c ubuntu-upgrade-linux-image-oem-20-04d ubuntu-upgrade-linux-image-oem-osp1 ubuntu-upgrade-linux-image-oracle ubuntu-upgrade-linux-image-oracle-lts-20-04 ubuntu-upgrade-linux-image-oracle-lts-22-04 ubuntu-upgrade-linux-image-raspi ubuntu-upgrade-linux-image-raspi-hwe-18-04 ubuntu-upgrade-linux-image-raspi-nolpae ubuntu-upgrade-linux-image-raspi2 ubuntu-upgrade-linux-image-snapdragon-hwe-18-04 ubuntu-upgrade-linux-image-virtual ubuntu-upgrade-linux-image-virtual-hwe-18-04 ubuntu-upgrade-linux-image-virtual-hwe-20-04 ubuntu-upgrade-linux-image-xilinx-zynqmp References https://attackerkb.com/topics/cve-2023-52340 CVE - 2023-52340 USN-6725-1 USN-6725-2 USN-6726-1 USN-6726-2 USN-6726-3