Several security vulnerabilities were discovered in the Linux kernel used in Google Cloud Platform (GCP) and Google Kubernetes Engine (GKE) systems, including a flaw known as VMSCAPE that allows insufficient branch predictor isolation between a guest VM and a userspace hypervisor. This could enable an attacker in a guest VM to potentially expose sensitive information from the host OS. Additional flaws affect the HSI, I2C, Bluetooth, and Timer subsystems. These issues could allow an attacker to compromise the system. Fixes have been released and require a system update and reboot.
DSPy versions up to 3.0.3 have an overly permissive sandbox configuration that allows attackers to read sensitive files when users build AI agents using the PythonInterpreter class. This vulnerability could lead to unauthorized disclosure of sensitive information.
MantisBT versions prior to 2.27.2 are vulnerable to a denial-of-service condition caused by a lack of server-side validation on note length. Attackers can submit extremely long notes (tested with over 4.7 million characters) that corrupt the issue activity logs, rendering the entire activity stream unviewable and preventing new notes from displaying. This breaks collaboration on affected issues. The vulnerability is fixed in version 2.27.2.
Starlette versions from 0.39.0 up to but not including 0.49.1 contain a vulnerability in the FileResponse component where processing of crafted HTTP Range headers triggers quadratic-time complexity. This can lead to CPU exhaustion and denial-of-service (DoS) conditions on endpoints serving files, including StaticFiles and any direct use of FileResponse. The vulnerability arises from inefficient parsing and merging of multiple range requests, allowing an unauthenticated attacker to cause high CPU usage with a single request.
Multiple security vulnerabilities were discovered in the Linux kernel for Oracle Cloud systems, affecting subsystems including Ext4, NFS server daemon, packet sockets, network traffic control, and VMware vSockets driver. These flaws could potentially allow an attacker to compromise the system. A security update addressing these issues is available and requires a system reboot. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled after the update.
Multiple security vulnerabilities were discovered in the Linux kernel version linux-oracle-6.8 affecting a wide range of subsystems including architectures (ARM32, ARM64, x86), various drivers, filesystems, networking protocols, and kernel infrastructure components. These vulnerabilities could potentially allow an attacker to compromise the system. A security update fixing these issues is available and requires a system reboot and recompilation of third-party kernel modules due to ABI changes.
Multiple security vulnerabilities were identified in the Linux kernel for the Azure platform, affecting various subsystems including network drivers, file systems, and protocol implementations. These flaws could potentially allow an attacker to compromise the system. A security update addressing these issues has been released and requires a system reboot and recompilation of third-party kernel modules due to ABI changes.
Multiple security vulnerabilities were discovered in the Linux kernel for Oracle Cloud systems affecting subsystems including Ext4 file system, NFS server daemon, packet sockets, network traffic control, and VMware vSockets driver. These flaws could potentially allow an attacker to compromise the system. A security update correcting these issues is available and requires a system reboot and recompilation of third-party kernel modules due to an ABI change.
CVE-2024-39508 is a vulnerability related to the io_uring/io-wq component where the functions set_bit() and test_bit() should be used on worker->flags. The description does not provide further technical details or impact information.