Demi Marie Obenour

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the xen/evtchn component of the Linux kernel and is caused by errors in resource management. When unbinding a user event channel, the related handler might be called a last time if the kernel was built with CONFIG DEBUG SHIRQ, potentially causing a WARN() in the handler. This can be avoided by adding an "unbinding" flag to struct user event, which will short circuit the handler. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samba versions prior to 4.6.16 Samba versions prior to 4.7.9 Samba versions prior to 4.8.4 Samba versions prior to 4.9.7 **Description** The issue is related to insufficient protection of service data, which may allow a remote attacker to disclose protected information. Specifically, an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC due to a problem with LDAP filters. **Recommendations** For versions prior to 4.6.16, update to version 4.6.16 or later. For versions prior to 4.7.9, update to version 4.7.9 or later. For versions prior to 4.8.4, update to version 4.8.4 or later. For versions prior to 4.9.7, update to version 4.9.7 or later.

**Name of the Vulnerable Software and Affected Versions** Trusted Firmware-A versions 2.8 and earlier **Description** The issue is related to an out-of-bounds read in the X.509 parser for parsing boot certificates. This affects the downstream use of `get ext` and `auth nvctr`. Attackers might be able to trigger dangerous read side effects or obtain sensitive information about microarchitectural state. **Recommendations** For versions 2.8 and earlier, consider disabling the X.509 parser for parsing boot certificates until a patch is available. Restrict access to the `get ext` and `auth nvctr` functions to minimize the risk of exploitation. Avoid using these functions in sensitive operations until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** GnuPG versions prior to 2.3.7 **Description** The issue is related to insufficient neutralization of special elements in a request, allowing a remote attacker to access and compromise confidential data. In unusual situations where an attacker possesses secret-key information from a victim's keyring and other constraints are met, such as the use of GPGME, signature forgery is possible via injection into the status line. **Recommendations** For GnuPG versions prior to 2.3.7, update to version 2.3.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of GPGME to minimize the risk of exploitation. Additionally, ensure that secret-key information is properly secured to prevent unauthorized access.

**Name of the Vulnerable Software and Affected Versions** GnuPG (affected versions not specified) **Description** The issue allows GnuPG to be made to spin on a relatively small input by crafting a public key with thousands of signatures attached, compressed down to just a few KB. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xen hypervisor (affected versions not specified) **Description** The issue is caused by synchronization errors when using a shared resource in the scsifront driver of the Xen hypervisor. Exploitation of this issue may allow an attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xen (affected versions not specified) **Description** The issue is caused by synchronization errors when using shared resources in components of the Xen hypervisor, including blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls. Exploitation of this issue may allow an attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xen hypervisor (affected versions not specified) **Description** The issue is caused by synchronization errors when using a shared resource in the blkfront driver of the Xen hypervisor. Exploitation of this issue may allow an attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xen (affected versions not specified) **Description** The issue is caused by synchronization errors when using a shared resource in the Xen hypervisor's paravirtualization (PV) mode implementation. This can be exploited to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xen hypervisor (affected versions not specified) **Description** The issue is caused by synchronization errors when using a shared resource in the gntalloc driver of the Xen hypervisor. Exploitation of this issue may allow an attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xen (affected versions not specified) **Description** The issue is caused by synchronization errors when using a shared resource in the xenbus component of the Xen hypervisor. Exploitation of this issue may allow an attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xen hypervisor netfront component (affected versions not specified) **Description** The issue is caused by synchronization errors when using a shared resource in the netfront component of the Xen hypervisor. Exploitation of this issue may allow an attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** RPM (affected versions not specified) **Description** The issue is related to insufficient authentication of data in the RPM software's signature check functionality. This allows an attacker to potentially corrupt the RPM database and execute code by convincing a victim to install a modified package. The highest threat from this issue is to data integrity, confidentiality, and system availability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.