3 ms·

My favorite: a Linux kernel pcmcia bug. On EC2 VMs.

• Sohcahtoa82 7mo ago
  In a similar vein: Raising alarms on a CVE in Apache2 that only affects Windows when the server is Linux. Or CVEs related to Bluetooth in cloud instances.
  • minetest2048 7mo ago
    Or raising alarm on a CVE in linux mlx5 driver on an embedded device that doesn't have a pcie interface
    • xyzzy123 7mo ago
      ReDoS at CVSS 8+ ... in the configuration file parsing of a bundler.
  • nikanj 7mo ago
    ”If you use that installed Python version to start a web server and use it to parse pdf, you may encounter a potential memory leak” Yeah so 1) not running a web service 2) not parsing pdf in said non-existing service 3) congrats you are leaking memory on my dev laptop
• bostik 7mo ago
  I'll top that: wireless-regdb out of date. Against an EC2-specific kernel.
  • xyzzy123 7mo ago
    Kernel headers out of date -> kernel vulnerability... in a container.
    • bostik 7mo ago
      Okay. You win.
• lokar 7mo ago
  I refused to refer to the whole vulnerability reporting / tracking effort as "security", always correcting people that it was compliance, not security.