[Git][security-tracker-team/security-tracker][master] 2 commits: CVE-2024-47176: Mention short-term mitigation available to users
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Sep 27 16:44:49 BST 2024
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
151d56f8 by Salvatore Bonaccorso at 2024-09-27T17:42:42+02:00
CVE-2024-47176: Mention short-term mitigation available to users
As patches are going to be deployed, still mention the avialable
short-term mitigations to users potentially affected by the recent cups
issues.
For servers: stop and remove the cups-browsed package.
For client/desktop systems: Remove 'cups' from the
"BrowseRemoteProtocols" line in /etc/cups/cups-browsed.conf and restart
the cups-browsed service.
Reiviewed-by: Santiago Ruano Rincón <santiago at debian.org>
Signed-off-by: Salvatore Bonaccorso <carnil at debian.org>
- - - - -
44329497 by Salvatore Bonaccorso at 2024-09-27T17:44:24+02:00
Merge Linux CVEs from kernel-sec
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,238 @@
+CVE-2024-46868 [firmware: qcom: uefisecapp: Fix deadlock in qcuefi_acquire()]
+ - linux 6.10.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/db213b0cfe3268d8b1d382b3bcc999c687a2567f (6.11)
+CVE-2024-46867 [drm/xe/client: fix deadlock in show_meminfo()]
+ - linux 6.10.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/9bd7ff293fc84792514aeafa06c5a17f05cb5f4b (6.11)
+CVE-2024-46866 [drm/xe/client: add missing bo locking in show_meminfo()]
+ - linux 6.10.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/94c4aa266111262c96c98f822d1bccc494786fee (6.11)
+CVE-2024-46865 [fou: fix initialization of grc]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/4c8002277167125078e6b9b90137bdf443ebaa08 (6.11)
+CVE-2024-46864 [x86/hyperv: fix kexec crash due to VP assist page corruption]
+ - linux 6.10.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/b9af6418279c4cf73ca073f8ea024992b38be8ab (6.11)
+CVE-2024-46863 [ASoC: Intel: soc-acpi-intel-lnl-match: add missing empty item]
+ - linux 6.10.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/c4246f1fe9f24f8dcd97887ed67d8fcfd91f4796 (6.11)
+CVE-2024-46862 [ASoC: Intel: soc-acpi-intel-mtl-match: add missing empty item]
+ - linux 6.10.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/bf6d7a44a144aa9c476dee83c23faf3151181bab (6.11)
+CVE-2024-46861 [usbnet: ipheth: do not stop RX on failing RX callback]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/74efed51e0a4d62f998f806c307778b47fc73395 (6.11-rc4)
+CVE-2024-46860 [wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/479ffee68d59c599f8aed8fa2dcc8e13e7bd13c3 (6.11-rc4)
+CVE-2024-46859 [platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses]
+ - linux 6.10.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/f52e98d16e9bd7dd2b3aef8e38db5cbc9899d6a4 (6.11)
+CVE-2024-46858 [mptcp: pm: Fix uaf in __timer_delete_sync]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/b4cd80b0338945a94972ac3ed54f8338d2da2076 (6.11)
+CVE-2024-46857 [net/mlx5: Fix bridge mode operations when there are no VFs]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/b1d305abef4640af1b4f1b4774d513cd81b10cfc (6.11)
+CVE-2024-46856 [net: phy: dp83822: Fix NULL pointer dereference on DP83825 devices]
+ - linux 6.10.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/3f62ea572b3e8e3f10c39a9cb4f04ca9ae5f2952 (6.11)
+CVE-2024-46855 [netfilter: nft_socket: fix sk refcount leaks]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/8b26ff7af8c32cb4148b3e147c52f9e4c695209c (6.11)
+CVE-2024-46854 [net: dpaa: Pad packets to ETH_ZLEN]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/cbd7ec083413c6a2e0c326d49e24ec7d12c7a9e0 (6.11)
+CVE-2024-46853 [spi: nxp-fspi: fix the KASAN report out-of-bounds bug]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/2a8787c1cdc7be24fdd8953ecd1a8743a1006235 (6.11)
+CVE-2024-46852 [dma-buf: heaps: Fix off-by-one in CMA heap fault handler]
+ - linux 6.10.11-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/ea5ff5d351b520524019f7ff7f9ce418de2dad87 (6.11)
+CVE-2024-46851 [drm/amd/display: Avoid race between dcn10_set_drr() and dc_state_destruct()]
+ - linux 6.10.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/a7aeb03888b92304e2fc7d4d1c242f54a312561b (6.11)
+CVE-2024-46850 [drm/amd/display: Avoid race between dcn35_set_drr() and dc_state_destruct()]
+ - linux 6.10.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/e835d5144f5ef78e4f8828c63e2f0d61144f283a (6.11)
+CVE-2024-46849 [ASoC: meson: axg-card: fix 'use-after-free']
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/4f9a71435953f941969a4f017e2357db62d85a86 (6.11)
+CVE-2024-46848 [perf/x86/intel: Limit the period on Haswell]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/25dfc9e357af8aed1ca79b318a73f2c59c1f0b2b (6.11-rc7)
+CVE-2024-46847 [mm: vmalloc: ensure vmap_block is initialised before adding to queue]
+ - linux 6.10.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/3e3de7947c751509027d26b679ecd243bc9db255 (6.11-rc7)
+CVE-2024-46846 [spi: rockchip: Resolve unbalanced runtime PM / system PM handling]
+ - linux 6.10.11-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/be721b451affbecc4ba4eaac3b71cdbdcade1b1b (6.11-rc7)
+CVE-2024-46845 [tracing/timerlat: Only clear timer if a kthread exists]
+ - linux 6.10.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/e6a53481da292d970d1edf0d8831121d1c5e2f0d (6.11-rc7)
+CVE-2024-46844 [um: line: always fill *error_out in setup_one_line()]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/824ac4a5edd3f7494ab1996826c4f47f8ef0f63d (6.11-rc1)
+CVE-2024-46843 [scsi: ufs: core: Remove SCSI host only if added]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/7cbff570dbe8907e23bba06f6414899a0fbb2fcc (6.11-rc1)
+CVE-2024-46842 [scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/ede596b1434b57c0b3fd5c02b326efe5c54f6e48 (6.11-rc1)
+CVE-2024-46841 [btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/a580fb2c3479d993556e1c31b237c9e5be4944a3 (6.11-rc1)
+CVE-2024-46840 [btrfs: clean up our handling of refs == 0 in snapshot delete]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/b8ccef048354074a548f108e51d0557d6adfd3a3 (6.11-rc1)
+CVE-2024-46839 [workqueue: Improve scalability of workqueue watchdog touch]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/98f887f820c993e05a12e8aa816c80b8661d4c87 (6.11-rc1)
+CVE-2024-46838 [userfaultfd: don't BUG_ON() if khugepaged yanks our page table]
+ - linux 6.10.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/4828d207dc5161dc7ddf9a4f6dcfd80c7dd7d20a (6.11-rc7)
+CVE-2024-46837 [drm/panthor: Restrict high priorities on group_create]
+ - linux 6.10.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/5f7762042f8a5377bd8a32844db353c0311a7369 (6.11-rc7)
+CVE-2024-46836 [usb: gadget: aspeed_udc: validate endpoint index for ast udc]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/ee0d382feb44ec0f445e2ad63786cd7f3f6a8199 (6.11-rc1)
+CVE-2024-46835 [drm/amdgpu: Fix smatch static checker warning]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/bdbdc7cecd00305dc844a361f9883d3a21022027 (6.11-rc1)
+CVE-2024-46834 [ethtool: fail closed if we can't get max channel used in indirection tables]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/2899d58462ba868287d6ff3acad3675e7adf934f (6.11-rc1)
+CVE-2024-46833 [net: hns3: void array out of bound when loop tnl_num]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/86db7bfb06704ef17340eeae71c832f21cfce35c (6.11-rc4)
+CVE-2024-46832 [MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/50f2b98dc83de7809a5c5bf0ccf9af2e75c37c13 (6.11-rc5)
+CVE-2024-46831 [net: microchip: vcap: Fix use-after-free error in kunit test]
+ - linux 6.10.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/a3c1e45156ad39f225cd7ddae0f81230a3b1e657 (6.11-rc7)
+CVE-2024-46830 [KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/4bcdd831d9d01e0fb64faea50732b59b2ee88da1 (6.11-rc7)
+CVE-2024-46829 [rtmutex: Drop rt_mutex::wait_lock before scheduling]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/d33d26036a0274b472299d7dcdaa5fb34329f91b (6.11-rc7)
+CVE-2024-46828 [sched: sch_cake: fix bulk flow accounting logic for host fairness]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/546ea84d07e3e324644025e2aae2d12ea4c5896e (6.11-rc7)
+CVE-2024-46827 [wifi: ath12k: fix firmware crash due to invalid peer nss]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/db163a463bb93cd3e37e1e7b10b9726fb6f95857 (6.11-rc1)
+CVE-2024-46826 [ELF: fix kernel.randomize_va_space double read]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/2a97388a807b6ab5538aa8f8537b2463c6988bd2 (6.11-rc1)
+CVE-2024-46825 [wifi: iwlwifi: mvm: use IWL_FW_CHECK for link ID check]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/9215152677d4b321801a92b06f6d5248b2b4465f (6.11-rc1)
+CVE-2024-46824 [iommufd: Require drivers to supply the cache_invalidate_user ops]
+ - linux 6.10.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/a11dda723c6493bb1853bbc61c093377f96e2d47 (6.11-rc1)
+CVE-2024-46823 [kunit/overflow: Fix UB in overflow_allocation_test]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/92e9bac18124682c4b99ede9ee3bcdd68f121e92 (6.11-rc4)
+CVE-2024-46822 [arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry]
+ - linux 6.10.11-1
+ NOTE: https://git.kernel.org/linus/2488444274c70038eb6b686cba5f1ce48ebb9cdd (6.11-rc1)
+CVE-2024-46821 [drm/amd/pm: Fix negative array index read]
+ - linux 6.10.9-1
+ NOTE: https://git.kernel.org/linus/c8c19ebf7c0b202a6a2d37a52ca112432723db5f (6.11-rc1)
+CVE-2024-46820 [drm/amdgpu/vcn: remove irq disabling in vcn 5 suspend]
+ - linux 6.10.9-1
+ NOTE: https://git.kernel.org/linus/10fe1a79cd1bff3048e13120e93c02f8ecd05e9d (6.11-rc1)
+CVE-2024-46819 [drm/amdgpu: the warning dereferencing obj for nbio_v7_4]
+ - linux 6.10.9-1
+ NOTE: https://git.kernel.org/linus/d190b459b2a4304307c3468ed97477b808381011 (6.11-rc1)
+CVE-2024-46818 [drm/amd/display: Check gpio_id before used as array index]
+ - linux 6.10.9-1
+ NOTE: https://git.kernel.org/linus/2a5626eeb3b5eec7a36886f9556113dd93ec8ed6 (6.11-rc1)
+CVE-2024-46817 [drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6]
+ - linux 6.10.9-1
+ NOTE: https://git.kernel.org/linus/84723eb6068c50610c5c0893980d230d7afa2105 (6.11-rc1)
+CVE-2024-46816 [drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links]
+ - linux 6.10.9-1
+ NOTE: https://git.kernel.org/linus/cf8b16857db702ceb8d52f9219a4613363e2b1cf (6.11-rc1)
+CVE-2024-46815 [drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]]
+ - linux 6.10.9-1
+ NOTE: https://git.kernel.org/linus/b38a4815f79b87efb196cd5121579fc51e29a7fb (6.11-rc1)
+CVE-2024-46814 [drm/amd/display: Check msg_id before processing transcation]
+ - linux 6.10.9-1
+ NOTE: https://git.kernel.org/linus/fa71face755e27dc44bc296416ebdf2c67163316 (6.11-rc1)
+CVE-2024-46813 [drm/amd/display: Check link_index before accessing dc->links[]]
+ - linux 6.10.9-1
+ NOTE: https://git.kernel.org/linus/8aa2864044b9d13e95fe224f32e808afbf79ecdf (6.11-rc1)
+CVE-2024-46812 [drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration]
+ - linux 6.10.9-1
+ NOTE: https://git.kernel.org/linus/a54f7e866cc73a4cb71b8b24bb568ba35c8969df (6.11-rc1)
+CVE-2024-46811 [drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box]
+ - linux 6.10.9-1
+ NOTE: https://git.kernel.org/linus/188fd1616ec43033cedbe343b6579e9921e2d898 (6.11-rc1)
+CVE-2024-46810 [drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ]
+ - linux 6.10.9-1
+ NOTE: https://git.kernel.org/linus/162e48cb1d84c2c966b649b8ac5c9d4f75f6d44f (6.11-rc1)
+CVE-2024-46809 [drm/amd/display: Check BIOS images before it is used]
+ - linux 6.10.9-1
+ NOTE: https://git.kernel.org/linus/8b0ddf19cca2a352b2a7e01d99d3ba949a99c84c (6.11-rc1)
+CVE-2024-46808 [drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range]
+ - linux 6.10.9-1
+ NOTE: https://git.kernel.org/linus/5524fa301ba649f8cf00848f91468e0ba7e4f24c (6.11-rc1)
+CVE-2024-46807 [drm/amd/amdgpu: Check tbo resource pointer]
+ - linux 6.10.9-1
+ NOTE: https://git.kernel.org/linus/6cd2b872643bb29bba01a8ac739138db7bd79007 (6.11-rc1)
+CVE-2024-46806 [drm/amdgpu: Fix the warning division or modulo by zero]
+ - linux 6.10.9-1
+ NOTE: https://git.kernel.org/linus/1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c (6.11-rc1)
+CVE-2024-46805 [drm/amdgpu: fix the waring dereferencing hive]
+ - linux 6.10.9-1
+ NOTE: https://git.kernel.org/linus/1940708ccf5aff76de4e0b399f99267c93a89193 (6.11-rc1)
+CVE-2024-46804 [drm/amd/display: Add array index check for hdcp ddc access]
+ - linux 6.10.9-1
+ NOTE: https://git.kernel.org/linus/4e70c0f5251c25885c31ee84a31f99a01f7cf50e (6.11-rc1)
+CVE-2024-46803 [drm/amdkfd: Check debug trap enable before write dbg_ev_file]
+ - linux 6.10.9-1
+ NOTE: https://git.kernel.org/linus/547033b593063eb85bfdf9b25a5f1b8fd1911be2 (6.11-rc1)
+CVE-2024-46802 [drm/amd/display: added NULL check at start of dc_validate_stream]
+ - linux 6.10.9-1
+ NOTE: https://git.kernel.org/linus/26c56049cc4f1705b498df013949427692a4b0d5 (6.11-rc1)
CVE-2024-9130 (The GiveWP \u2013 Donation Plugin and Fundraising Platform plugin for ...)
NOT-FOR-US: WordPress plugin
CVE-2024-9049 (The Beaver Builder \u2013 WordPress Page Builder plugin for WordPress ...)
@@ -235,6 +470,9 @@ CVE-2024-47176 (CUPS is a standards-based, open-source printing system, and `cup
NOTE: https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8
NOTE: https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
NOTE: Fixed by: https://github.com/OpenPrinting/cups-browsed/commit/1debe6b140c37e0aa928559add4abcc95ce54aa2
+ NOTE: Mitigations cover: For servers, stop and remove the cups-browsed package. For
+ NOTE: client/desktop systems: Remove 'cups' from the "BrowseRemoteProtocols" line in
+ NOTE: /etc/cups/cups-browsed.conf and restart the cups-browsed service.
CVE-2024-8861 (The ProfileGrid \u2013 User Profiles, Groups and Communities plugin fo ...)
NOT-FOR-US: WordPress plugin
CVE-2024-8803 (The Bulk NoIndex & NoFollow Toolkit plugin for WordPress is vulnerable ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/00127b3a3a610ba4eea1500632cbaf96feba81f4...44329497b437bd79a2b62b70a1d8703e4e4b74b7
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/00127b3a3a610ba4eea1500632cbaf96feba81f4...44329497b437bd79a2b62b70a1d8703e4e4b74b7
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240927/4a6d0405/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list