PT-2024-16243

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory,...

WPE WebKit Memory Cell Access DoS

The vulnerability of the WPE WebKit and WebKitGTK page rendering modules relates to access to memory cells before the buffer is initialized. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data, compromise its integrity, and cause service failures...

kernel: Information disclosure in vhost/vhost.c:vhost_new_msg()

A vulnerability was found in vhostnewmsg in drivers/vhost/vhost.c in the Linux kernel, which does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhostnewmsg function. This issue can allow local privileged users to read...

Uninitialized Memory Exposure

Overview apache-airflow is a platform to programmatically author, schedule, and monitor workflows. Affected versions of this package are vulnerable to Uninitialized Memory Exposure which allows authenticated users with audit log access to see sensitive unencrypted stored values set via the airflo...

AZL-52526 CVE-2024-50110 affecting package kernel for versions less than 6.6.64.2-1

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix one more kernel-infoleak in algo dumping During fuzz testing, the following issue was discovered: BUG: KMSAN: kernel-infoleak in copytoiter+0x598/0x2a30 copytoiter+0x598/0x2a30 skbdatagramiter+0x168/0x1060...

UBUNTU-CVE-2024-50110

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix one more kernel-infoleak in algo dumping During fuzz testing, the following issue was discovered: BUG: KMSAN: kernel-infoleak in copytoiter+0x598/0x2a30 copytoiter+0x598/0x2a30 skbdatagramiter+0x168/0x1060...

CVE-2024-50105

CVE-2024-50105 relates to the Linux kernel ASoC Qualcomm Soundwire path. The SC7280 Soundwire runtime stream allocation was not updated when allocation was moved to per-machine soundcard drivers, risking NULL pointer dereference or uninitialized memory during playback. The fix (commit 15c7fab0e04...

CVE-2024-50076

In the Linux kernel, the following vulnerability has been resolved: vt: prevent kernel-infoleak in confontget font.data may not initialize all memory spaces depending on the implementation of vc-vcsw-confontget. This may cause info-leak, so to prevent this, it is safest to modify it to initialize...

UBUNTU-CVE-2024-50088

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix uninitialized pointer free in addinoderef The addinoderef function does not initialize the "name" struct when it is declared. If any of the following calls to "readoneinode returns NULL, dir = readoneinoderoot,...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from uninitialized allocated memory space in the confontget function, which could lead to an information leak...

PT-2024-33919

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue arises in the Linux kernel's btrfs component, specifically within the read alloc one name function. This function does not properly initialize the name field of the fscrypt s...

HFS+ File System Heap Buffer Overflow DoS

The vulnerability of the hfspluslistxattr function in the fs/hfsplus/xattr.c file of the Linux kernel’s HFS+ file system is related to the use of uninitialized memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and accessibility of the protected...

PT-2024-33938

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the Linux kernel, specifically the ASoC: qcom: sc7280 component. A commit moved the allocation of Soundwire stream runtime from the Qualcomm Soundwire driver to...

AZL-51242 CVE-2024-50035 affecting package kernel for versions less than 6.6.57.1-1

In the Linux kernel, the following vulnerability has been resolved: ppp: fix pppasyncencode illegal access syzbot reported an issue in pppasyncencode 1 In this case, pppoesendmsg is called with a zero size. Then pppasyncencode is called with an empty skb. BUG: KMSAN: uninit-value in pppasyncencod...

AZL-51395 CVE-2024-49975 affecting package kernel for versions less than 5.15.173.1-1

In the Linux kernel, the following vulnerability has been resolved: uprobes: fix kernel info leak via "uprobes" vma xoladdvma maps the uninitialized page allocated by createxolarea into userspace. On some architectures x86 this memory is readable even without VMREAD, VMEXEC results in the same...

AZL-52041 CVE-2024-49972 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Deallocate DML memory if allocation fails Why When DC state create DML memory allocation fails, memory is not deallocated subsequently, resulting in uninitialized structure that is not NULL. How Deallocate memory...

imagemagick:encoder_dng_fuzzer: Use-of-uninitialized-value in LibRaw_bigfile_datastream::get_char

Detailed Report: https://oss-fuzz.com/testcase?key=6469284609458176 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderdngfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: LibRawbigfiledatastream::getcha...

ffmpeg:ffmpeg_SWS_fuzzer: Use-of-uninitialized-value in hScale8To15_c

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5841199968092160 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegSWSfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

Oracle VirtualBox BusLogic Uninitialized Memory Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within...

h3:fuzzerPolygonToCellsExperimental: Segv on unknown address in std::__Fuzzer::pair<std::__Fuzzer::__hash_iterator<std::__Fuzzer::__hash_node<st

Detailed Report: https://oss-fuzz.com/testcase?key=6231362262073344 Project: h3 Fuzzing Engine: libFuzzer Fuzz Target: fuzzerPolygonToCellsExperimental Job Type: libfuzzermsanh3 Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...