Search threats, CVEs… ⌘K
Vendor advisories

Microsoft Security Response Center

Browse 15,985 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 5 hours ago Checked every 6 hours
All vendor sources Official source

15,985 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2024-35955
HighCVSS 8.8

kprobes: Fix possible use-after-free issue on kprobe registration

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.157.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.28.1-1 on Azure Linux 3.0, azl3 kernel 6.6.82.1-1 on Azure Linux 3.0, cbl2 kernel 5.15.176.3-3 on CBL Mariner 2.0
Fixed versions5.15.157.1-1, 6.6.28.1-1, 5.15.179.1-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-35955
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-42083
MediumCVSS 5.5

ionic: fix kernel panic due to multi-buffer handling

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.162.2-1 on CBL Mariner 2.0, azl3 kernel 6.6.43.1-7 on Azure Linux 3.0, cbl2 kernel 5.15.182.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.92.2-1 on Azure Linux 3.0
Fixed versions5.15.162.2-1, 6.6.43.1-7
Vendor guidance

CBL-Mariner Releases

CVE-2024-42083
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-34088
HighCVSS 7.5

In FRRouting (FRR) through 9.1 it is possible for the get_edge() function in ospf_te.c in the OSPF daemon to return a NULL pointer. In cases where calling functions do not handle the returned NULL value the OSPF daemon crashes leading to denial of service.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 frr 8.5.3-6 on CBL Mariner 2.0, cbl2 frr 8.5.3-6 on CBL-Mariner 2.0
Fixed versions8.5.3-6
Vendor guidance

CBL-Mariner Releases

CVE-2024-34088
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2023-52755
HighCVSS 8.4

ksmbd: fix slab out of bounds write in smb_inherit_dacl()

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.82.1-1 on Azure Linux 3.0, cbl2 kernel 5.15.176.3-3 on CBL Mariner 2.0, cbl2 kernel 5.15.176.3-3 on CBL-Mariner 2.0, cbl2 kernel 5.15.140.1-1 on CBL Mariner 2.0
Fixed versions6.6.3.1-1, 5.15.179.1-1, 5.15.140.1-1
Vendor guidance

CBL-Mariner Releases

CVE-2023-52755
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-6874
MediumCVSS 4.3

macidn punycode buffer overread

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 curl 8.8.0-1 on CBL Mariner 2.0, azl3 cmake 3.30.3-2 on Azure Linux 3.0, azl3 curl 8.8.0-1 on Azure Linux 3.0, azl3 cmake 3.30.3-6 on Azure Linux 3.0
Fixed versions8.8.0-1, 3.30.3-2
Vendor guidance

CBL-Mariner Releases

CVE-2024-6874
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-36972
HighCVSS 7.5

af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.176.3-1 on CBL Mariner 2.0, azl3 kernel 6.6.64.2-9 on Azure Linux 3.0, azl3 kernel 6.6.78.1-3 on Azure Linux 3.0, cbl2 kernel 5.15.176.3-3 on CBL Mariner 2.0
Fixed versions5.15.176.3-1, 6.6.64.2-9, 5.15.179.1-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-36972
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2023-51589
MediumCVSS 5.4

BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure Vulnerability

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 bluez 5.63-6 on CBL Mariner 2.0, cbl2 bluez 5.63-6, cbl2 bluez 5.63-6 on CBL-Mariner 2.0, azl3 bluez 5.63-6 on Azure Linux 3.0
CVE-2023-51589
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-41110
CriticalCVSS 9.9

Moby authz zero length regression

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 moby-engine 24.0.9-7 on CBL Mariner 2.0, azl3 moby-engine 25.0.3-5 on Azure Linux 3.0, azl3 moby-engine 25.0.3-13 on Azure Linux 3.0, cbl2 moby-engine 24.0.9-17 on CBL Mariner 2.0
Fixed versions24.0.9-7, 25.0.3-5
Vendor guidance

CBL-Mariner Releases

CVE-2024-41110
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2023-50230
HighCVSS 7.1

BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 bluez 5.63-5 on Azure Linux 3.0
Fixed versions5.63-5
Vendor guidance

CBL-Mariner Releases

CVE-2023-50230
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-44337
MediumCVSS 5.1

The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion `v0.0.0-20240729232818-a2a9c4f`, which corresponds with commit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252`, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252` contains fixes to this problem.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 cri-o 1.22.3-11 on CBL Mariner 2.0, cbl2 cri-o 1.22.3-14 on CBL Mariner 2.0, cbl2 cri-o 1.22.3-14 on CBL-Mariner 2.0
Fixed versions1.22.3-11
Vendor guidance

CBL-Mariner Releases

CVE-2024-44337
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2021-47323
HighCVSS 8.8

watchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff()

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.82.1-1 on Azure Linux 3.0, cbl2 kernel 5.15.176.3-3 on CBL-Mariner 2.0, cbl2 kernel 5.15.176.3-3 on CBL Mariner 2.0
Fixed versions6.6.85.1-1, 5.15.179.1-1
Vendor guidance

CBL-Mariner Releases

CVE-2021-47323
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-40902
HighCVSS 7.8

jfs: xattr: fix buffer overflow for invalid xattr

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.162.2-1 on CBL Mariner 2.0, azl3 kernel 6.6.35.1-1 on Azure Linux 3.0, cbl2 kernel 5.15.160.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.22.1-2 on Azure Linux 3.0
Fixed versions5.15.162.2-1, 6.6.35.1-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-40902
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-32884
MediumCVSS 6.4

gix-transport indirect code execution via malicious username

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 rust 1.72.0-8 on CBL Mariner 2.0, azl3 rust 1.75.0-9 on Azure Linux 3.0, cbl2 rust 1.72.0-10 on CBL Mariner 2.0, cbl2 rust 1.72.0-10 on CBL-Mariner 2.0
Fixed versions1.72.0-8, 1.75.0-9
Vendor guidance

CBL-Mariner Releases

CVE-2024-32884
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-39494
HighCVSS 7.8

ima: Fix use-after-free on a dentry's dname.name

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.176.3-1 on CBL Mariner 2.0, azl3 kernel 6.6.35.1-5 on Azure Linux 3.0, cbl2 kernel 5.15.182.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.22.1-2 on Azure Linux 3.0
Fixed versions5.15.176.3-1, -, 6.6.35.1-5
Vendor guidance

CBL-Mariner Releases

CVE-2024-39494
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-21096
MediumCVSS 4.9

Vulnerability in the MySQL Server product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Confidentiality Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 mariadb 10.6.20-1 on CBL Mariner 2.0, cbl2 mysql 8.0.40-1 on CBL Mariner 2.0, azl3 mysql 8.0.40-1 on Azure Linux 3.0, azl3 mariadb 10.11.10-1 on Azure Linux 3.0
Fixed versions10.6.20-1, 8.0.40-1, 10.11.10-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-21096
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2023-50229
HighCVSS 7.1

BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 bluez 5.63-6 on CBL Mariner 2.0, cbl2 bluez 5.63-6 on CBL-Mariner 2.0, azl3 bluez 5.63-5 on Azure Linux 3.0, azl3 bluez 5.63-6 on Azure Linux 3.0
Fixed versions5.63-6, 5.63-5
Vendor guidance

CBL-Mariner Releases

CVE-2023-50229
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-39495
HighCVSS 7.8

greybus: Fix use-after-free bug in gb_interface_release due to race condition.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 kernel 5.15.162.2-1 on CBL Mariner 2.0, azl3 kernel 6.6.35.1-1 on Azure Linux 3.0, cbl2 kernel 5.15.160.1-1 on CBL Mariner 2.0, azl3 kernel 6.6.22.1-2 on Azure Linux 3.0
Fixed versions5.15.162.2-1, 6.6.35.1-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-39495
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-5187
HighCVSS 8.8

Arbitrary File Overwrite in download_model_with_test_data in onnx/onnx

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 pytorch 2.2.2-3 on Azure Linux 3.0, azl3 pytorch 2.2.2-7 on Azure Linux 3.0
Fixed versions2.2.2-3
Vendor guidance

CBL-Mariner Releases

CVE-2024-5187
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-27983
HighCVSS 8.2

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 nodejs 20.14.0-1 on Azure Linux 3.0, azl3 nodejs 20.10.0-2 on Azure Linux 3.0, cbl2 nodejs18 18.18.2-7 on CBL Mariner 2.0, cbl2 nodejs18 18.18.2-7 on CBL-Mariner 2.0
Fixed versions20.14.0-1, 18.18.2-7
Vendor guidance

CBL-Mariner Releases

CVE-2024-27983
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-21194
MediumCVSS 4.9

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 mysql 8.0.40-1 on CBL Mariner 2.0, azl3 mysql 8.0.40-1 on Azure Linux 3.0, cbl2 mysql 8.0.36-1 on CBL Mariner 2.0, cbl2 mysql 8.0.36-1 on CBL-Mariner 2.0
Fixed versions8.0.40-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-21194
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-1737
HighCVSS 7.5

BIND's database will be slow if a very large number of RRs exist at the same name

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 bind 9.20.0-1 on Azure Linux 3.0, azl3 bind 9.19.21-1 on Azure Linux 3.0, cbl2 bind 9.16.50-1 on CBL Mariner 2.0, cbl2 bind 9.16.50-1 on CBL-Mariner 2.0
Fixed versions9.20.0-1, 9.16.50-1, 4.4.3.P1-2
Vendor guidance

CBL-Mariner Releases

CVE-2024-1737
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2023-26964
HighCVSS 7.5

An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result the memory and CPU usage are high which can lead to a Denial of Service (DoS).

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 rpm-ostree 2022.1-7 on Azure Linux 3.0, azl3 rust 1.86.0-1 on Azure Linux 3.0, cbl2 kata-containers 3.2.0.azl0-1 on CBL Mariner 2.0, cbl2 rpm-ostree 2022.1-7 on CBL Mariner 2.0
Fixed versions2024.4-1, h2-0.3.26, 3.2.0.azl0-1, 2022.1-7
Vendor guidance

CBL-Mariner Releases

CVE-2023-26964
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-31080
HighCVSS 7.3

Xorg-x11-server: heap buffer overread/data leakage in procxigetselectedevents

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 xorg-x11-server 1.20.10-11 on CBL Mariner 2.0, cbl2 xorg-x11-server 1.20.10-15 on CBL Mariner 2.0, cbl2 xorg-x11-server 1.20.10-15 on CBL-Mariner 2.0
Fixed versions1.20.10-11
Vendor guidance

CBL-Mariner Releases

CVE-2024-31080
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-21193
MediumCVSS 4.9

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 mysql 8.0.40-1 on CBL Mariner 2.0, azl3 mysql 8.0.40-1 on Azure Linux 3.0, cbl2 mysql 8.0.36-1 on CBL Mariner 2.0, azl3 mysql 8.0.36-1 on Azure Linux 3.0
Fixed versions8.0.40-1
Vendor guidance

CBL-Mariner Releases

CVE-2024-21193
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources