Vendor advisories

Microsoft Security Response Center

Browse 15,985 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 5 hours ago Checked every 6 hours

15,985 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2022-29654
MediumCVSS 5.5

Buffer overflow vulnerability in quote_for_pmake in asm/nasm.c in nasm before 2.15.05 allows attackers to cause a denial of service via crafted file.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 tensorflow 2.11.1-2 on CBL-Mariner 2.0, azl3 tensorflow 2.16.1-9 on Azure Linux 3.0, cbl2 tensorflow 2.11.1-2 on CBL Mariner 2.0
Microsoft Security Response CenterCVE-2024-24576
CriticalCVSS 10.0

Rusts's `std::process::Command` did not properly escape arguments of batch files on Windows

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 rust 1.75.0-14 on Azure Linux 3.0, cbl2 rust 1.72.0-10 on CBL Mariner 2.0, azl3 rust 1.86.0-1 on Azure Linux 3.0, cbl2 rust 1.72.0-10 on CBL-Mariner 2.0
Microsoft Security Response CenterCVE-2024-42064
MediumCVSS 5.5

drm/amd/display: Skip pipe if the pipe idx not set properly

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.96.2-1 on Azure Linux 3.0, azl3 kernel 6.6.96.2-2 on Azure Linux 3.0, azl3 kernel 6.6.112.1-2 on Azure Linux 3.0, azl3 kernel 6.6.117.1-1 on Azure Linux 3.0
Microsoft Security Response CenterCVE-2024-47678
MediumCVSS 9.4

icmp: change the order of rate limits

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.56.1-5 on Azure Linux 3.0, azl3 kernel 6.6.51.1-5 on Azure Linux 3.0
Fixed versions6.6.56.1-5
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-47191
HighCVSS 7.1

pam_oath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because in the context of PAM code running as root it mishandles usersfile access such as by calling fchown in the presence of a symlink.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 oath-toolkit 2.6.9-2 on Azure Linux 3.0, cbl2 oath-toolkit 2.6.7-3 on CBL Mariner 2.0, cbl2 oath-toolkit 2.6.7-3 on CBL-Mariner 2.0
Fixed versions2.6.9-2, 2.6.7-3
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-42070
MediumCVSS 5.5

netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.162.2-1 on CBL Mariner 2.0, azl3 kernel 6.6.43.1-7 on Azure Linux 3.0, azl3 kernel 6.6.35.1-5 on Azure Linux 3.0, cbl2 kernel 5.15.160.1-1 on CBL Mariner 2.0
Fixed versions5.15.162.2-1, 6.6.43.1-7
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2023-29941
MediumCVSS 5.5

llvm-project commit a0138390 was discovered to contain a segmentation fault via the component matchAndRewriteSortOp(mlir::sparse_tensor::SortOp.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 llvm16 16.0.0-4 on CBL Mariner 2.0, cbl2 clang16 16.0.0-2 on CBL Mariner 2.0, azl3 tensorflow 2.16.1-1 on Azure Linux 3.0, azl3 tensorflow 2.11.1-1 on Azure Linux 3.0
Fixed versions16.0.0-4, 16.0.0-2, 2.16.1-1
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-42228
HighCVSS 7.0

drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.167.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.43.1-7 on Azure Linux 3.0, cbl2 kernel 5.15.180.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.35.1-5 on Azure Linux 3.0
Fixed versions5.15.167.1-1, 6.6.43.1-7
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-49856
Medium

x86/sgx: Fix deadlock in SGX NUMA node search

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.173.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.56.1-5 on Azure Linux 3.0, cbl2 kernel 5.15.167.1-2 on CBL-Mariner 2.0, cbl2 kernel 5.15.167.1-2 on CBL Mariner 2.0
Fixed versions5.15.173.1-1, 6.6.56.1-5
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-42114
MediumCVSS 4.4

wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.167.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.164.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.164.1-1 on CBL-Mariner 2.0
Fixed versions5.15.167.1-1
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-42077
MediumCVSS 5.5

ocfs2: fix DIO failure due to insufficient transaction credits

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.162.2-1 on CBL Mariner 2.0, azl3 kernel 6.6.43.1-7 on Azure Linux 3.0, cbl2 kernel 5.15.160.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.35.1-5 on Azure Linux 3.0
Fixed versions5.15.162.2-1, 6.6.43.1-7
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-9355
MediumCVSS 6.5

Golang-fips: golang fips zeroed buffer

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 golang 1.22.9-1 on Azure Linux 3.0, azl3 golang 1.22.7-3 on Azure Linux 3.0
Fixed versions1.22.9-1
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-47685
CriticalCVSS 9.1

netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.173.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.56.1-5 on Azure Linux 3.0, cbl2 kernel 5.15.167.1-2 on CBL Mariner 2.0, cbl2 kernel 5.15.167.1-2 on CBL-Mariner 2.0
Fixed versions5.15.173.1-1, 6.6.56.1-5
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-42080
MediumCVSS 5.5

RDMA/restrack: Fix potential invalid address access

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.162.2-1 on CBL Mariner 2.0, azl3 kernel 6.6.43.1-7 on Azure Linux 3.0, cbl2 kernel 5.15.160.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.160.1-1 on CBL-Mariner 2.0
Fixed versions5.15.162.2-1, 6.6.43.1-7
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-47728
MediumCVSS 5.5

bpf: Zero former ARG_PTR_TO_{LONGINT} args in case of error

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.56.1-5 on Azure Linux 3.0, azl3 kernel 6.6.51.1-5 on Azure Linux 3.0
Fixed versions6.6.56.1-5
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-22189
HighCVSS 7.5

QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 coredns 1.11.1-6 on CBL Mariner 2.0, azl3 coredns 1.11.1-2 on Azure Linux 3.0, azl3 coredns 1.11.1-4 on Azure Linux 3.0, cbl2 coredns 1.11.1-18 on CBL Mariner 2.0
Fixed versions1.11.1-6, 1.11.1-2
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-33602
MediumCVSS 8.6

nscd: netgroup cache assumes NSS callback uses in-buffer strings

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 glibc 2.38-10 on Azure Linux 3.0, cbl2 glibc 2.35-7 on CBL Mariner 2.0
Fixed versions2.35-7
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2023-45288
HighCVSS 7.5

HTTP/2 CONTINUATION flood in net/http

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 application-gateway-kubernetes-ingress 1.7.2-3 on Azure Linux 3.0, azl3 etcd 3.5.12-2 on Azure Linux 3.0, azl3 docker-cli 25.0.3-3 on Azure Linux 3.0, azl3 containerd 1.7.13-8 on Azure Linux 3.0
Fixed versions1.7.7-1, 3.5.18-1, 25.0.7-1, 1.7.13-6
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-47764
Medium

cookie accepts cookie name path and domain with out of bounds characters

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 reaper 3.1.1-13 on CBL Mariner 2.0, cbl2 reaper 3.1.1-18 on CBL-Mariner 2.0, cbl2 reaper 3.1.1-18 on CBL Mariner 2.0
Fixed versions3.1.1-13
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-47747
HighCVSS 7.0

net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.173.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.56.1-5 on Azure Linux 3.0, azl3 kernel 6.6.51.1-5 on Azure Linux 3.0, cbl2 kernel 5.15.167.1-2 on CBL Mariner 2.0
Fixed versions5.15.173.1-1, 6.6.56.1-5
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-42227
MediumCVSS 4.7

drm/amd/display: Fix overlapping copy within dml_core_mode_programming

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.96.2-1 on Azure Linux 3.0, azl3 kernel 6.6.96.2-2 on Azure Linux 3.0, azl3 kernel 6.6.104.2-4 on Azure Linux 3.0
Microsoft Security Response CenterCVE-2024-33599
HighCVSS 8.1

nscd: Stack-based buffer overflow in netgroup cache

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 glibc 2.38-11 on Azure Linux 3.0, cbl2 glibc 2.35-7 on CBL Mariner 2.0, cbl2 glibc 2.35-7 on CBL-Mariner 2.0
Fixed versions2.38-11, 2.35-7
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2023-49921
MediumCVSS 5.2

An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.

Mariner

Affected productscbl2 rubygem-elasticsearch 8.3.0-1, azl3 rubygem-elasticsearch 8.9.0-1 on Azure Linux 3.0, cbl2 rubygem-elasticsearch 8.3.0-1 on CBL-Mariner 2.0
Microsoft Security Response CenterCVE-2024-26875
Medium

media: pvrusb2: fix uaf in pvr2_context_set_notify

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.167.1-2 on CBL Mariner 2.0, azl3 kernel 6.6.57.1-5 on Azure Linux 3.0
Fixed versions5.15.167.1-2, 6.6.57.1-5
Vendor guidance

CBL-Mariner Releases

Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources