SUSE CVE-2022-48833

In the Linux kernel, the following vulnerability has been resolved: btrfs: skip reserved bytes warning on unmount after log cleanup failure After the recent changes made by commit c2e39305299f01 "btrfs: clear extent buffer uptodate when we fail to write it" and its followup fix, commit...

SUSE CVE-2021-47622

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: Fix a deadlock in the error handler The following deadlock has been observed on a test setup: - All tags allocated - The SCSI error handler calls ufshcdehhostresethandler - ufshcdehhostresethandler queues work that cal...

kernel: nvme: fix reconnection fail due to reserved tag allocation

CVE-2024-27435 is a Linux kernel vulnerability in the NVMe over RDMA implementation, where a reconnection failure occurs due to a deadlock caused by reserved tag allocation. The issue arises when the admin queue is quiesced while resetting the controller, causing a keep-alive request to hold the...

CVE-2023-7012

CVE-2023-7012 affects Google Chrome’s Permission Prompts due to insufficient data validation, potentially enabling a sandbox escape when a user runs a malicious app. Described for Chrome versions before 117.0.5938.62; exploitation requires user interaction and a malicious file. Astra Linux bullet...

CVE-2024-3176

CVE-2024-3176 affects Google Chrome with an out-of-bounds write in SwiftShader triggered by a crafted HTML page, enabling remote memory corruption. Chrome versions prior to 117.0.5938.62 are vulnerable; upgrade to 117.0.5938.62 or later to mitigate. Other connected sources corroborate the same Ch...

CVE-2023-4860

CVE-2023-4860 affects Google Chrome (Skia) via an inappropriate Skia implementation in Chromium before 115.0.5790.98, allowing a remote attacker who has compromised the renderer process to potentially escape the sandbox by crafting an HTML page. The vulnerability is rooted in the Skia component a...

CVE-2023-7010

CVE-2023-7010 is a use-after-free vulnerability in WebRTC in Google Chrome, with impact described as potential heap corruption. The affected software is Google Chrome (WebRTC component); the concrete detail provided indicates exploitation could be remote via a crafted HTML page, and the vulnerabi...

CVE-2019-25154

The CVE-2019-25154 entry describes an Inappropriate implementation in iframe handling in Google Chrome prior to 77.0.3865.75, which could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Affected software is Google Chrome (Chromium-based); the underlying is...

CVE-2024-5500

CVE-2024-5500 affects Google Chrome prior to 1.3.36.351, due to an inappropriate Sign-In implementation that could allow a remote attacker to bypass navigation restrictions via a crafted HTML page. The vulnerability impacts Chrome across platforms and is documented in the Chrome release notes and...

CVE-2024-3172

CVE-2024-3172 concerns Insufficient data validation in DevTools of Google Chrome prior to 121.0.6167.85. A remote attacker could trick a user into UI gestures to execute arbitrary code via a crafted HTML page. Affected software: Google Chrome (DevTools). Root cause: input/data validation gaps in ...

CVE-2024-3174

The CVE-2024-3174 entry describes an issue in Google Chrome/Chromium’s V8: an inappropriate implementation allowed remote attackers to potentially trigger object corruption via a crafted HTML page. Affected version set is before 119.0.6045.105 (Chromium), with High severity per NVD. The vulnerabi...

CVE-2024-3170

CVE-2024-3170 affects Google Chrome prior to 121.0.6167.85, where a Use-after-Free in WebRTC could allow a remote attacker to cause heap corruption via a crafted HTML page. The issue is in Chromium’s WebRTC handling and is addressed by updating Chrome to 121.0.6167.85 or later. Public exploits ex...

CVE-2024-3169

The CVE-2024-3169 issue affects Google Chrome (V8/Chromium) and is caused by a Use after free in V8, leading to potential heap corruption via a crafted HTML page. Affected software includes Google Chrome with V8, prior to 121.0.6167.139. Impact is high: remote attacker could potentially exploit t...

CVE-2023-7011

CVE-2023-7011 describes an improper implementation in Google Chrome’s Picture in Picture (PiP) feature that allowed a remote attacker to spoof the Omnibox contents via a crafted HTML page. Affected software is Google Chrome (PiP module) prior to version 119.0.6045.105. The underlying issue is an ...

UBUNTU-CVE-2022-48833

In the Linux kernel, the following vulnerability has been resolved: btrfs: skip reserved bytes warning on unmount after log cleanup failure After the recent changes made by commit c2e39305299f01 "btrfs: clear extent buffer uptodate when we fail to write it" and its followup fix, commit...

CVE-2021-47622

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: Fix a deadlock in the error handler The following deadlock has been observed on a test setup: - All tags allocated - The SCSI error handler calls ufshcdehhostresethandler - ufshcdehhostresethandler queues work that cal...

DEBIAN-CVE-2021-47622

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: Fix a deadlock in the error handler The following deadlock has been observed on a test setup: - All tags allocated - The SCSI error handler calls ufshcdehhostresethandler - ufshcdehhostresethandler queues work that cal...

CVE-2024-38709

CVE-2024-38709 corresponds to a Local File Inclusion in the WordPress plugin GD Rating System (versions <= 3.6). The underlying issue is path traversal that allows including restricted files via the plugin’s handling of file paths. Public entries consistently identify the affected software as ...

CVE-2024-34721

CVE-2024-34721 describes an information-disclosure in Android’s MediaProvider.java, in ensureFileColumns, where improper input validation may allow a user to disclose files owned by another user. This is a local disclosure with no extra execution privileges required and does not require user inte...

CVE-2024-34726

The CVE-2024-34726 issue is in PVRSRV_MMap (pvr_bridge_k.c) of the PVR bridge kernel module. A logic error in PVRSRV_MMap can allow arbitrary code execution, enabling local kernel escalation of privilege with no extra execution privileges and without user interaction. The available documents do n...