Red Hat RHSA-2024:6346 Advisory: PCP Heap Overflow and Symlink Privilege Escalation (CVE-2024-45769, CVE-2024-45770)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability ID: RHSA-2024:6346. 2. Release Date: September 19, 2024. 3. Type/Severity: Security Advisory, Important. 4. Subject: pcp updates are now available for Red Hat Enterprise Linux 8. 5. Description: - PCP is a suite of tools, services, and libraries for performance monitoring. - PCP’s lightweight distributed architecture makes it particularly suitable for centralized analysis of complex systems. - Security fixes: - pcp: pmpost symlink attack allows PCP to escalate to root user. - pcp: pmcd heap overflow via metric pmstore operation. 6. Affected Products: - Red Hat Enterprise Linux for x86_64 8 x86_64 - Red Hat Enterprise Linux for IBM z Systems 8 s390x - Red Hat Enterprise Linux for Power, little endian 8 ppc64le - Red Hat Enterprise Linux for ARM 64 8 aarch64 7. Fixes: - BZ - 2310451 - CVE-2024-45770 pcp: pmpost symlink attack allows PCP to escalate to root user. - BZ - 2310452 - CVE-2024-45769 pcp: pmcd heap overflow via metric pmstore operation. - RHEL-17081 - /usr/share/pcp/lib/pmdaproc.sh does not require dependency on diffutils when using diff. - RHEL-29708 - Performance copilot gives 'day of year out of range' error when date is January 1. - RHEL-58002 - PCP pmcd.log fills /var filesystem with too many open files messages. 8. CVEs: - CVE-2024-45769 - CVE-2024-45770 9. Reference Links: - https://access.redhat.com/security/updates/classification/#important This information provides a detailed description of the vulnerability, a list of affected products, remediation measures, and associated CVEs, helping users understand and address the security risks.

Goal Reached Thanks to every supporter — we hit 100%!

Red Hat RHSA-2024:6346 Advisory: PCP Heap Overflow and Symlink Privilege Escalation (CVE-2024-45769, CVE-2024-45770)

More from this source