Vendor advisories

Microsoft Security Response Center

Browse 15,985 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 5 hours ago Checked every 6 hours

15,985 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2024-47755
Medium

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.167.1-2 on CBL Mariner 2.0, azl3 kernel 6.6.56.1-5 on Azure Linux 3.0, cbl2 kernel 5.15.167.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.51.1-5 on Azure Linux 3.0
Fixed versions5.15.167.1-2, 6.6.56.1-5
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-33601
HighCVSS 7.5

nscd: netgroup cache may terminate daemon on memory allocation failure

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 glibc 2.38-11 on Azure Linux 3.0, cbl2 glibc 2.35-7 on CBL Mariner 2.0, cbl2 glibc 2.35-7 on CBL-Mariner 2.0
Fixed versions2.38-11, 2.35-7
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-41810
MediumCVSS 6.1

HTML injection in HTTP redirect body

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 python-twisted 22.10.0-3 on CBL Mariner 2.0, azl3 python-twisted 22.10.0-3 on Azure Linux 3.0, azl3 python-twisted 22.10.0-4 on Azure Linux 3.0, cbl2 python-twisted 22.10.0-4 on CBL Mariner 2.0
Fixed versions22.10.0-3
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-30260
LowCVSS 4.3

Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch request stream pipeline

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 nodejs18 18.20.2-1 on CBL Mariner 2.0, azl3 nodejs 20.14.0-1 on Azure Linux 3.0, azl3 nodejs 20.10.0-2 on Azure Linux 3.0, cbl2 nodejs18 18.18.2-7 on CBL Mariner 2.0
Fixed versions18.20.2-1, 20.14.0-1
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2021-47324
HighCVSS 8.8

watchdog: Fix possible use-after-free in wdt_startup()

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.176.3-3 on CBL Mariner 2.0, cbl2 kernel 5.15.176.3-3 on CBL-Mariner 2.0, azl3 kernel 6.6.82.1-1 on Azure Linux 3.0
Fixed versions5.15.179.1-1, 6.6.85.1-1
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-47749
MediumCVSS 5.5

RDMA/cxgb4: Added NULL check for lookup_atid

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.173.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.56.1-5 on Azure Linux 3.0, cbl2 kernel 5.15.167.1-2 on CBL Mariner 2.0, cbl2 kernel 5.15.167.1-2 on CBL-Mariner 2.0
Fixed versions5.15.173.1-1, 6.6.56.1-5
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-33600
MediumCVSS 5.9

nscd: Null pointer crashes after notfound response

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 glibc 2.38-11 on Azure Linux 3.0, cbl2 glibc 2.35-7 on CBL-Mariner 2.0, cbl2 glibc 2.35-7 on CBL Mariner 2.0
Fixed versions2.38-11, 2.35-7
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-42230
MediumCVSS 4.4

powerpc/pseries: Fix scv instruction crash with kexec

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.43.1-7 on Azure Linux 3.0, azl3 kernel 6.6.35.1-5 on Azure Linux 3.0
Fixed versions6.6.43.1-7
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2023-50966
HighCVSS 5.3

erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value in a JOSE header.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 rabbitmq-server 3.11.24-2 on CBL Mariner 2.0, azl3 rabbitmq-server 3.13.7-1 on Azure Linux 3.0, azl3 rabbitmq-server 3.13.0-1 on Azure Linux 3.0, cbl2 rabbitmq-server 3.11.24-3 on CBL Mariner 2.0
Fixed versions3.11.24-2, 3.13.7-1
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-42152
MediumCVSS 4.7

nvmet: fix a possible leak when destroy a ctrl during qp establishment

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.164.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.43.1-7 on Azure Linux 3.0, cbl2 kernel 5.15.162.2-1 on CBL-Mariner 2.0, azl3 kernel 6.6.35.1-5 on Azure Linux 3.0
Fixed versions5.15.164.1-1, 6.6.43.1-7
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-47554
MediumCVSS 5.3

Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 apache-commons-io 2.14.0-1 on CBL Mariner 2.0, azl3 apache-commons-io 2.14.0-1 on Azure Linux 3.0, cbl2 javapackages-bootstrap 1.5.0-6 on CBL Mariner 2.0
Fixed versions2.14.0-1
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-38545
HighCVSS 7.8

RDMA/hns: Fix UAF for cq async event

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.176.3-1 on CBL Mariner 2.0, cbl2 kernel 5.15.180.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.180.1-1 on CBL-Mariner 2.0
Fixed versions5.15.176.3-1
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-42075
MediumCVSS 5.5

bpf: Fix remap of arena.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.162.2-1 on CBL Mariner 2.0, azl3 kernel 6.6.43.1-7 on Azure Linux 3.0, cbl2 kernel 5.15.180.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.180.1-1 on CBL-Mariner 2.0
Fixed versions5.15.162.2-1, 6.6.43.1-7
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-31852
MediumCVSS 5.9

LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So if this function is covered by any testing the miscompile is most likely to be discovered before the binary is shipped to production."

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 rust 1.72.0-8 on CBL Mariner 2.0, cbl2 clang16 16.0.0-1 on CBL Mariner 2.0, azl3 libcxx 18.1.2-3 on Azure Linux 3.0, azl3 compiler-rt 18.1.2-2 on Azure Linux 3.0
Fixed versions1.72.0-8, 16.0.0-1, 18.1.2-3, 18.1.2-2
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-41011
HighCVSS 7.8

drm/amdkfd: don't allow mapping the MMIO HDP page with large pages

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.167.1-1 on CBL Mariner 2.0, cbl2 kernel 5.15.164.1-1 on CBL-Mariner 2.0, cbl2 kernel 5.15.164.1-1 on CBL Mariner 2.0
Fixed versions5.15.167.1-1
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-28182
MediumCVSS 5.3

Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 fluent-bit 3.0.6-1 on CBL Mariner 2.0, cbl2 rust 1.68.0-1 on CBL Mariner 2.0, cbl2 nodejs18 18.20.3-1 on CBL Mariner 2.0, cbl2 cmake 3.21.4-14 on CBL Mariner 2.0
Fixed versions3.0.6-1, 1.68.0-1, 18.20.3-1, 3.21.4-14
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-34062
MediumCVSS 4.8

tqdm CLI arguments injection attack

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 conda 24.1.2-2 on Azure Linux 3.0, azl3 python-tqdm 4.66.2-2 on Azure Linux 3.0, azl3 conda 4.11.0-1 on Azure Linux 3.0, cbl2 python-tqdm 4.63.1-3 on CBL Mariner 2.0
Fixed versions24.1.2-2, 4.66.2-2, 4.63.1-3
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-47684
MediumCVSS 5.5

tcp: check skb is non-NULL in tcp_rto_delta_us()

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.173.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.56.1-5 on Azure Linux 3.0, azl3 kernel 6.6.51.1-5 on Azure Linux 3.0, cbl2 kernel 5.15.167.1-2 on CBL Mariner 2.0
Fixed versions5.15.173.1-1, 6.6.56.1-5
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2023-2975
MediumCVSS 5.3

AES-SIV implementation ignores empty associated data entries

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 hvloader 1.0.1-5 on CBL Mariner 2.0, cbl2 hvloader 1.0.1-6 on CBL Mariner 2.0, cbl2 hvloader 1.0.1-5 on CBL-Mariner 2.0
Fixed versions1.0.1-6
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2019-20503
MediumCVSS 6.5

usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 usrsctp 0.9.5.0-1 on CBL Mariner 2.0, azl3 usrsctp 0.9.5.0-1 on Azure Linux 3.0
Fixed versions0.9.5.0-1
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-49859
MediumCVSS 7.8

f2fs: fix to check atomic_file in f2fs ioctl interfaces

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.56.1-5 on Azure Linux 3.0, azl3 kernel 6.6.51.1-5 on Azure Linux 3.0
Fixed versions6.6.56.1-5
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-42225
HighCVSS 7.5

wifi: mt76: replace skb_put with skb_put_zero

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.163.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.43.1-7 on Azure Linux 3.0, cbl2 kernel 5.15.162.2-1 on CBL Mariner 2.0, azl3 kernel 6.6.35.1-5 on Azure Linux 3.0
Fixed versions5.15.163.1-1, 6.6.43.1-7, 5.15.164.1-1
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2023-4133
MediumCVSS 5.5

Kernel: cxgb4: use-after-free in ch_flower_stats_cb()

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 hyperv-daemons 5.15.180.1-1, cbl2 hyperv-daemons 5.15.180.1-1 on CBL-Mariner 2.0
Microsoft Security Response CenterCVE-2024-47757
HighCVSS 7.1

nilfs2: fix potential oob read in nilfs_btree_check_delete()

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.173.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.56.1-5 on Azure Linux 3.0, azl3 kernel 6.6.51.1-5 on Azure Linux 3.0, cbl2 kernel 5.15.167.1-2 on CBL Mariner 2.0
Fixed versions5.15.173.1-1, 6.6.56.1-5
Vendor guidance

CBL-Mariner Releases

Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources