Malicious code in ref-indexer (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2950 Malicious code in ref-indexer (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2021-47585

CVE-2021-47585 concerns a memory leak in the Linux kernel's btrfs __add_inode_ref path. The issue arises from allocating victim_name with kmalloc at two points (lines 1104 and 1169) and returning from the function without freeing the previously allocated memory when backref_in_log() returns an er...

CVE-2024-38580

In the Linux kernel, the following vulnerability has been resolved: epoll: be better about file lifetimes epoll can call out to vfspoll with a file pointer that may race with the last 'fput'. That would make fcount go down to zero, and while the ep-mtx locking means that the resulting file pointe...

PT-2024-28404

Name of the Vulnerable Software and Affected Versions huggingface/text-generation-inference versions up to and including v2.0.0 Description A code injection issue exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The issue arises...

CVE-2021-47539

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix rxrpcpeer leak in rxrpclookupbundle Need to call rxrpcputpeer for bundle candidate before kfree as it holds a ref to rxrpcpeer. DH: v2: Changed to abstract out the bundle freeing code into a function...

DEBIAN-CVE-2021-47546

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix memory leak in fib6rulesuppress The kernel leaks memory when a fib rule is present in IPv6 nftables firewall rules and a suppressprefix rule is present in the IPv6 routing rules used by certain tools such as wg-quick. I...

CVE-2021-47538

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix rxrpclocal leak in rxrpclookuppeer Need to call rxrpcputlocal for peer candidate before kfree as it holds a ref to rxrpclocal. DH: v2: Changed to abstract the peer freeing code out into a function...

CVE-2021-47539

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix rxrpcpeer leak in rxrpclookupbundle Need to call rxrpcputpeer for bundle candidate before kfree as it holds a ref to rxrpcpeer. DH: v2: Changed to abstract out the bundle freeing code into a function...

CVE-2021-47538

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix rxrpclocal leak in rxrpclookuppeer Need to call rxrpcputlocal for peer candidate before kfree as it holds a ref to rxrpclocal. DH: v2: Changed to abstract the peer freeing code out into a function...

CVE-2021-47538 rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix rxrpclocal leak in rxrpclookuppeer Need to call rxrpcputlocal for peer candidate before kfree as it holds a ref to rxrpclocal. DH: v2: Changed to abstract the peer freeing code out into a function...

CVE-2021-47538 rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix rxrpclocal leak in rxrpclookuppeer Need to call rxrpcputlocal for peer candidate before kfree as it holds a ref to rxrpclocal. DH: v2: Changed to abstract the peer freeing code out into a function...

CVE-2023-52879

In the Linux kernel, the following vulnerability has been resolved: tracing: Have traceeventfile have ref counters The following can crash the kernel: cd /sys/kernel/tracing echo 'p:sched schedule' kprobeevents exec 5events/kprobes/sched/enable kprobeevents exec 5&- The above commands: 1. Change...

SUSE CVE-2024-35197

gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths that clash with such names writes arbitrary data to the devices. This allows a repository, when cloned, to cause indefinite blocking or the...

Prototype Pollution

@apidevtools/json-schema-ref-parser is vulnerable to Prototype Pollution. The vulnerability is due to inadequate input validation in the bundle, parse, resolve, and dereference functions, allowing a remote attacker to execute arbitrary code...

PT-2024-8951

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a memory leak caused by the missing cgroup bpf offline function in the Linux kernel. This leak occurs when the CONFIG CGROUP BPF option is enabled. The leak can...

CVE-2023-52879

In the Linux kernel, the following vulnerability has been resolved: tracing: Have traceeventfile have ref counters The following can crash the kernel: cd /sys/kernel/tracing echo 'p:sched schedule' kprobeevents exec 5events/kprobes/sched/enable kprobeevents exec 5&- The above commands: 1. Change...

CVE-2023-52879

The CVE-2023-52879 issue concerns the Linux kernel tracing subsystem, specifically the trace_event_file object used for tracefs events. A use-after-free can occur when a kprobe event is deleted while a user-space process still holds an opened “enable” file descriptor for that event, because the u...

CVE-2023-52879 tracing: Have trace_event_file have ref counters

In the Linux kernel, the following vulnerability has been resolved: tracing: Have traceeventfile have ref counters The following can crash the kernel: cd /sys/kernel/tracing echo 'p:sched schedule' kprobeevents exec 5events/kprobes/sched/enable kprobeevents exec 5&- The above commands: 1. Change...

CVE-2021-47232

In the Linux kernel, the following vulnerability has been resolved: can: j1939: fix Use-after-Free, hold skb ref while in use This patch fixes a Use-after-Free found by the syzbot. The problem is that a skb is taken from the per-session skb queue, without incrementing the ref count. This leads to...