CVE-2022-41972

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to 4.9 contain a NULL Pointer Dereference in BLE L2CAP module. The Contiki-NG operating system for IoT devices contains a Bluetooth Low Energy stack. An attacker can inject a packet in th...

CVE-2022-41972: NULL Pointer Dereference

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to 4.9 contain a NULL Pointer Dereference in BLE L2CAP module. The Contiki-NG operating system for IoT devices contains a Bluetooth Low Energy stack. An attacker can inject a packet in th...

GSD-2022-1008307 capabilities: fix undefined behavior in bit shift for CAP_TO_MASK

capabilities: fix undefined behavior in bit shift for CAPTOMASK This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.300 by commit...

GSD-2022-1008256 net: mdio: fix undefined behavior in bit shift for __mdiobus_register

net: mdio: fix undefined behavior in bit shift for mdiobusregister This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.265 by commit...

PT-2022-36336 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 2.6.25 through 5.10.154 Description: The issue concerns undefined behavior in bit shift for CAP TO MASK. It was introduced in version v2.6.25 and fixed in version v5.10.155. The actual impact and attack plausibility have...

PT-2022-36611

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.334 Description The issue concerns undefined behavior in bit shift for CAP TO MASK. It was introduced in version v2.6.25 and fixed in version v4.9.334. The actual impact and attack plausibility have not yet...

PT-2022-36614

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.333 Description The issue concerns undefined behavior in bit shift for mdiobus register in the Linux Kernel's MDIO module. This problem was introduced in version v2.6.28 and fixed in version v4.9.333. The...

PT-2022-36054

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.0.9 Description The issue concerns undefined behavior in bit shift for CAP TO MASK. It was introduced in version v2.6.25 and fixed in Linux Kernel version v6.0.9. The actual impact and attack plausibility have...

PT-2022-36242

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.78 Description The issue concerns undefined behavior in bit shift for mdiobus register in the Linux Kernel's MDIO module. The actual impact and attack plausibility have not yet been proven. Recommendations...

PT-2022-36211

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.79 Description The issue concerns undefined behavior in bit shift for CAP TO MASK. It was introduced in version v2.6.25 and fixed in version v5.15.79. The actual impact and attack plausibility have not yet...

PT-2022-36562 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.300 Description: The issue concerns undefined behavior in bit shift for CAP TO MASK. It was introduced in version v2.6.25 and fixed in version v4.14.300. The actual impact and attack plausibility have not...

PT-2022-36511 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.265 Description: The issue concerns undefined behavior in bit shift for mdiobus register in the Linux Kernel's MDIO module. The actual impact and attack plausibility have not yet been proven...

PT-2022-36095 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.8 Description: The issue concerns undefined behavior in bit shift for mdiobus register in the Linux Kernel's MDIO module. The actual impact and attack plausibility have not yet been proven. Recommendations:...

PT-2022-37431 · Unknown · Parity-Util-Mem

Name of the Vulnerable Software and Affected Versions: parity-util-mem affected versions not specified Description: The issue concerns the use of a global allocator that may lead to undefined behavior UB. There is a warning related to its use. Recommendations: At the moment, there is no informati...

OESA-2022-2109 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR,WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort,shear and transform images,...

assimp:assimp_fuzzer: Bad-cast to Assimp::BaseImporterAssimp::Importer::ReadFile in Assimp::BatchLoader::LoadAll

Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=5086163820216320 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzer Job Type: libfuzzerubsanassimp Platform Id: linux Crash Type: Bad-cast Crash Address: 0x000003e7e880 Crash State:...

Invalid char to bool conversion when printing a tensor

Impact When printing a tensor, we get it's data as a const char array since that's the underlying storage and then we typecast it to the element type. However, conversions from char to bool are undefined if the char is not 0 or 1, so sanitizers/fuzzers will crash. Patches We have patched the issu...

MGASA-2022-0430 Updated vim packages fix security vulnerability

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. CVE-2022-2000, CVE-2022-2129, CVE-2022-2210 Use After Free in GitHub repository vim/vim prior to 8.2. CVE-2022-2042 Buffer Over-read in GitHub repository vim/vim prior to 8.2. CVE-2022-2124, CVE-2022-2175 Heap-based Buffer Overflow in...

CVE-2022-41911

TensorFlow is an open source platform for machine learning. When printing a tensor, we get it's data as a "const char" array since that's the underlying storage and then we typecast it to the element type. However, conversions from "char" to "bool" are undefined if the "char" is not "0" or "1", s...

CVE-2022-41911: Incorrect Type Conversion or Cast

TensorFlow is an open source platform for machine learning. When printing a tensor, we get it's data as a const char array since that's the underlying storage and then we typecast it to the element type. However, conversions from char to bool are undefined if the char is not 0 or 1, so...