NCSC-2024-0339

Microsoft heeft kwetsbaarheden verholpen in Mariner (Azure Linux).

De kwetsbaarheden betreffen oudere kwetsbaarheden in diverse subcomponenten van de distro, zoals Python, Emacs, Qemu, Django, Curl, wget etc. welke in de nieuwe versie zijn verholpen.

Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:

https://portal.msrc.microsoft.com/en-us/security-guidance

medium

high

Misinterpretation of Input

Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Heap-based Buffer Overflow

Out-of-bounds Read

Improper Validation of Array Index

Partial String Comparison

Integer Overflow or Wraparound

Integer Underflow (Wrap or Wraparound)

Off-by-one Error

Improper Input Validation

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Improper Privilege Management

Improper Check for Dropped Privileges

Improper Handling of Insufficient Permissions or Privileges

Improper Certificate Validation

Improper Validation of Certificate with Host Mismatch

Improper Check for Certificate Revocation

Cleartext Transmission of Sensitive Information

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Divide By Zero

CWE-371

Uncontrolled Resource Consumption

Missing Release of Memory after Effective Lifetime

Improper Resource Shutdown or Release

Use After Free

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

NULL Pointer Dereference

Insertion of Sensitive Information into Log File

Improper Locking

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Allocation of Resources Without Limits or Throttling

Missing Release of Resource after Effective Lifetime

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Out-of-bounds Write

Deadlock

Loop with Unreachable Exit Condition ('Infinite Loop')

Incorrect Authorization

Server-Side Request Forgery (SSRF)

Improper Control of Generation of Code ('Code Injection')

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')