PT-2022-35134 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue is related to a potential dir corruption in ext4 when the ext4 dx add entry function fails. The actual impact and attack plausibility have not yet been proven. Recommendations: For...

PT-2022-35382 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.75 Description: The issue concerns a lack of sanity check on destination blkaddr during recovery in the f2fs component. This could potentially lead to security vulnerabilities, although the actual impact a...

PT-2022-35139 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue concerns the ext2 filesystem in the Linux Kernel, where sanity checks for group and filesystem size have been added. The actual impact and attack plausibility of this issue have not...

PT-2022-35257 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.75 Description: The issue is related to the use of kvmalloc for the group descriptor array in ext2. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

PT-2022-35065 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue concerns stricter integer overflow checks in the f fs gadget of the Linux Kernel. It was introduced in version v3.14 and fixed in version v6.0.3. The actual impact and attack...

PT-2022-6379 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel version 6.0.8 Description: The issue is related to a use-after-free vulnerability in the ntfs trim fs function of the fs/ntfs3/bitmap.c component in the Linux kernel. This vulnerability may allow an attacker to impact the...

CVE-2022-40981

The CVE-2022-40981 issue affects ETIC Telecom Remote Access Server (RAS) prior to 4.7.0 (versions 4.5.0 and earlier). Technical details from connected sources describe three vulnerabilities in RAS: CVE-2022-3703 (insufficient verification of data authenticity) allowing rogue firmware backdoors wi...

CVE-2022-41874

Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri is vulnerable to an Incorrectly-Resolved Name. Due to incorrect escaping of special characters in paths selected via the file dialog and drag and drop functionality, it is...

Path traversal

dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users. Some Java application frameworks, including those used ...

CVE-2022-41874 Tauri Filesystem Scope can be Partially Bypassed

Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri is vulnerable to an Incorrectly-Resolved Name. Due to incorrect escaping of special characters in paths selected via the file dialog and drag and drop functionality, it is...

RHEL 8 : e2fsprogs (RHSA-2022:7720)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7720 advisory. The e2fsprogs packages provide a number of utilities for creating, checking, modifying, and correcting the ext2, ext3, and ext4 file systems. Securit...

Tauri Filesystem Scope can be Partially Bypassed

Impact Due to incorrect escaping of special characters in paths selected via the file dialog and drag and drop functionality, it was possible to partially bypass the fs scope definition. It was not possible to traverse into arbitrary paths, as the issue was limited to neighboring files and sub...

GHSA-Q9WV-22M9-VHQH Tauri Filesystem Scope can be Partially Bypassed

Impact Due to incorrect escaping of special characters in paths selected via the file dialog and drag and drop functionality, it was possible to partially bypass the fs scope definition. It was not possible to traverse into arbitrary paths, as the issue was limited to neighboring files and sub...

e2fsprogs: out-of-bounds read/write via crafted filesystem

An out-of-bounds read/write vulnerability was found in e2fsprogs. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem...

Moderate: Red Hat Security Advisory: e2fsprogs security and bug fix update

An update for e2fsprogs is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

golang: io/fs: stack exhaustion in Glob

A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to impact availability...

kernel: use-after-free and memory errors in ext4 when mounting and operating on a corrupted image

A use-after-free flaw was found in fs/ext4/namei.c:dxinsertblock in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service...

kernel: nfs_atomic_open() returns uninitialized data instead of ENOTDIR

A flaw was found in the Linux kernel. When an application tries to open a directory using the ODIRECTORY flag in a mounted NFS filesystem, a lookup operation is performed. If the NFS server returns a file as a result of the lookup, the NFS filesystem returns an uninitialized file descriptor inste...

PT-2025-18550

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, related to the btrfs filesystem. When cloning a btrfs device, the associated btrfs zoned device info structure is not cloned, leadi...

Jenkins Filesystem Trigger Plugin XML External Entity Expansion (CVE-2021-21659)

An XML external entity expansion vulnerability exists in Jenkins Filesystem Trigger Plugin. Successful exploitation of this vulnerability could result in the disclosure of file contents from the target system...