Vendor advisories

Microsoft Security Response Center

Browse 15,985 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 5 hours ago Checked every 6 hours

15,985 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2024-38381
HighCVSS 7.1

nfc: nci: Fix uninit-value in nci_rx_work

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.162.2-1 on CBL Mariner 2.0, azl3 kernel 6.6.51.1-1 on Azure Linux 3.0, cbl2 kernel 5.15.176.3-3 on CBL Mariner 2.0, cbl2 kernel 5.15.176.3-3 on CBL-Mariner 2.0
Fixed versions5.15.162.2-1, 6.6.51.1-1
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-46871
High

drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.176.3-1 on CBL Mariner 2.0, cbl2 kernel 5.15.180.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.180.1-1 on CBL-Mariner 2.0
Fixed versions5.15.176.3-1
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-9026
LowCVSS 3.3

PHP-FPM logs from children may be altered

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 php 8.1.30-1 on CBL Mariner 2.0, azl3 php 8.3.12-1 on Azure Linux 3.0, cbl2 php 8.1.29-1 on CBL Mariner 2.0, azl3 php 8.3.8-1 on Azure Linux 3.0
Fixed versions8.1.30-1, 8.3.12-1
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-32886
MediumCVSS 4.9

Vitess vulnerable to infinite memory consumption and vtgate crash

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 vitess 17.0.7-1 on CBL Mariner 2.0, azl3 vitess 19.0.4-1 on Azure Linux 3.0, azl3 vitess 19.0.4-7 on Azure Linux 3.0, cbl2 vitess 17.0.7-7 on CBL-Mariner 2.0
Fixed versions17.0.7-1, 19.0.4-1
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-42071
MediumCVSS 5.5

ionic: use dev_consume_skb_any outside of napi

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.162.2-1 on CBL Mariner 2.0, azl3 kernel 6.6.43.1-7 on Azure Linux 3.0, cbl2 kernel 5.15.180.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.92.2-1 on Azure Linux 3.0
Fixed versions5.15.162.2-1, 6.6.43.1-7
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-40977
MediumCVSS 5.5

wifi: mt76: mt7921s: fix potential hung tasks during chip recovery

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1, cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0
Microsoft Security Response CenterCVE-2024-47673
Medium

wifi: iwlwifi: mvm: pause TCM when the firmware is stopped

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.176.3-1 on CBL Mariner 2.0, azl3 kernel 6.6.56.1-5 on Azure Linux 3.0, cbl2 kernel 5.15.180.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.180.1-1 on CBL-Mariner 2.0
Fixed versions5.15.176.3-1, 6.6.56.1-5
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-38630
HighCVSS 7.8

watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.200.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.202.1-1 on CBL-Mariner 2.0
Microsoft Security Response CenterCVE-2024-38538
HighCVSS 7.1

net: bridge: xmit: make sure we have at least eth header len bytes

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.176.3-1 on CBL Mariner 2.0, cbl2 kernel 5.15.182.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.182.1-1 on CBL-Mariner 2.0
Fixed versions5.15.176.3-1
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-42082
MediumCVSS 5.5

xdp: Remove WARN() from __xdp_reg_mem_model()

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.162.2-1 on CBL Mariner 2.0, azl3 kernel 6.6.43.1-7 on Azure Linux 3.0, cbl2 kernel 5.15.160.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.35.1-5 on Azure Linux 3.0
Fixed versions5.15.162.2-1, 6.6.43.1-7
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-47695
HighCVSS 7.8

RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.173.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.56.1-5 on Azure Linux 3.0, cbl2 kernel 5.15.167.1-2 on CBL Mariner 2.0, cbl2 kernel 5.15.167.1-2 on CBL-Mariner 2.0
Fixed versions5.15.173.1-1, 6.6.56.1-5
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-20328
MediumCVSS 5.3

ClamAV VirusEvent File Processing Command Injection Vulnerability

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 clamav 1.0.6-1 on Azure Linux 3.0, azl3 clamav 0.105.2-4 on Azure Linux 3.0, cbl2 clamav 0.105.2-5 on CBL Mariner 2.0, cbl2 clamav 0.105.2-5 on CBL-Mariner 2.0
Fixed versions1.0.6-1, 0.105.2-5
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-30261
LowCVSS 3.5

Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 nodejs18 18.20.2-1 on CBL Mariner 2.0, azl3 nodejs 20.14.0-1 on Azure Linux 3.0, azl3 nodejs 20.10.0-2 on Azure Linux 3.0, cbl2 nodejs18 18.18.2-7 on CBL-Mariner 2.0
Fixed versions18.20.2-1, 20.14.0-1
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-47814
LowCVSS 3.9

use-after-free when closing buffers in Vim

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 vim 9.1.0791-1 on CBL Mariner 2.0, azl3 vim 9.1.0791-1 on Azure Linux 3.0, cbl2 vim 9.0.2121-5 on CBL Mariner 2.0, cbl2 vim 9.0.2121-5 on CBL-Mariner 2.0
Fixed versions9.1.0791-1
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-41671
HighCVSS 8.3

twisted.web has disordered HTTP pipeline response

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 python-twisted 22.10.0-3 on CBL Mariner 2.0, azl3 python-twisted 22.10.0-3 on Azure Linux 3.0, cbl2 python-twisted 22.10.0-4 on CBL Mariner 2.0, azl3 python-twisted 22.10.0-4 on Azure Linux 3.0
Fixed versions22.10.0-3
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-49851
Medium

tpm: Clean up TPM space after command failure

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.173.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.56.1-5 on Azure Linux 3.0, cbl2 kernel 5.15.167.1-2 on CBL Mariner 2.0, cbl2 kernel 5.15.167.1-2 on CBL-Mariner 2.0
Fixed versions5.15.173.1-1, 6.6.56.1-5
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-42229
MediumCVSS 4.1

crypto: aeadcipher - zeroize key buffer after use

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.164.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.43.1-7 on Azure Linux 3.0, cbl2 kernel 5.15.162.2-1 on CBL Mariner 2.0, azl3 kernel 6.6.35.1-5 on Azure Linux 3.0
Fixed versions5.15.164.1-1, 6.6.43.1-7
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-47683
MediumCVSS 5.5

drm/amd/display: Skip Recompute DSC Params if no Stream on Link

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.56.1-5 on Azure Linux 3.0, azl3 kernel 6.6.51.1-5 on Azure Linux 3.0
Fixed versions6.6.56.1-5
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2018-21035
HighCVSS 7.5

In Qt through 5.14.1 the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscm1 qt5-qtsvg 5.12.11-2 on CBL Mariner 1.0, cbl2 qt5-qtsvg 5.12.11-3 on CBL Mariner 2.0
Fixed versions5.12.11-2, 5.12.11-3
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-8927
HighCVSS 7.5

cgi.force_redirect configuration is bypassable due to the environment variable collision

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 php 8.1.30-1 on CBL Mariner 2.0, azl3 php 8.3.12-1 on Azure Linux 3.0, cbl2 php 8.1.29-1 on CBL Mariner 2.0, azl3 php 8.3.8-1 on Azure Linux 3.0
Fixed versions8.1.30-1, 8.3.12-1
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-42069
MediumCVSS 5.5

net: mana: Fix possible double free in error handling path

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.43.1-7 on Azure Linux 3.0, azl3 kernel 6.6.35.1-5 on Azure Linux 3.0
Fixed versions6.6.43.1-7
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-50062
MediumCVSS 5.5

RDMA/rtrs-srv: Avoid null pointer deref during path establishment

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.173.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.57.1-1 on Azure Linux 3.0, cbl2 kernel 5.15.167.1-2 on CBL Mariner 2.0, cbl2 kernel 5.15.167.1-2 on CBL-Mariner 2.0
Fixed versions5.15.173.1-1, 6.6.57.1-1
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-27982
MediumCVSS 6.5

The team has identified a critical vulnerability in the http server of the most recent version of Node where malformed headers can lead to HTTP request smuggling. Specifically if a space is placed before a content-length header it is not interpreted correctly enabling attackers to smuggle in a second request within the body of the first.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 nodejs18 18.20.2-1 on CBL Mariner 2.0, azl3 nodejs 20.14.0-1 on Azure Linux 3.0, cbl2 nodejs18 18.18.2-7 on CBL-Mariner 2.0, azl3 nodejs 20.10.0-2 on Azure Linux 3.0
Fixed versions18.20.2-1, 20.14.0-1
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-31449
HighCVSS 7.0

Lua library commands may lead to stack overflow and RCE in Redis

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 redis 6.2.14-3 on CBL Mariner 2.0, azl3 valkey 8.0.1-1 on Azure Linux 3.0, cbl2 redis 6.2.14-2 on CBL Mariner 2.0, cbl2 redis 6.2.14-2 on CBL-Mariner 2.0
Fixed versions6.2.14-3, 8.0.1-1
Vendor guidance

CBL-Mariner Releases

Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources