CVE-2024-42227 drm/amd/display: Fix overlapping copy within dml_core_mode_programming

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix overlapping copy within dmlcoremodeprogramming WHY &modelib-mp.Watermark and &locals-Watermark are the same address. memcpy may lead to unexpected behavior. HOW memmove should be used...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that originates from a UBSAN array index out-of-bounds in the bnx2x module when using systems with more than 32 physical CPU cor...

CVE-2024-42227: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix overlapping copy within dmlcoremodeprogramming WHY &modelib-mp.Watermark and &locals-Watermark are the same address. memcpy may lead to unexpected behavior. HOW memmove should be used...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from packets remaining external when a rule is flushed or removed, so this WARNON should be removed...

MAL-2024-7831 Malicious code in byted-cg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 90e251b9f3c49de738ecec6d31759290c20383f748735d901d797110fd1b6fb2 The OpenSSF Package Analysis project identified 'byted-cg' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

XMP Toolkit's `XmpFile::close` can trigger undefined behavior

Affected versions of the crate failed to catch C++ exceptions raised within the XmpFile::close function. If such an exception occurred, it would trigger undefined behavior, typically a process abort. This is best demonstrated in issue 230, where a race condition causes the close call to fail due ...

Malicious code in rtxt-dep2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3a0cd03149005afa6cc505bea16d80c21f5bbbd226c16c659ed6abb41cf730a2 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-4698 Malicious code in cugraph-dgl (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6c1f145fd51ee7737cb44e28b07d4ec3bfe53f4a8aac51d0b8bce58ef8bd71f7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

`XmpFile::close` can trigger UB

Affected versions of the crate failed to catch C++ exceptions raised within the XmpFile::close function. If such an exception occured, it would trigger undefined behavior, typically a process abort. This is best demonstrated in issue 230, where a race condition causes the close call to fail due t...

SUSE CVE-2024-40987

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix UBSAN warning in kvdpm.c Adds bounds check for sumovidmappingentry...

PT-2024-40915 · Unknown · Xmp Toolkit

Name of the Vulnerable Software and Affected Versions: xmp toolkit versions prior to 1.9.0 Description: The issue arises when C++ exceptions are raised within the XmpFile::close function, leading to undefined behavior, typically a process abort. This can be triggered by a race condition causing...

Moderate: Red Hat Security Advisory: security update Logging for Red Hat OpenShift - 5.6.21

Moderate -- Logging for Red Hat OpenShift - 5.6.21 Logging for Red Hat OpenShift - 5.6.21 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses CVE-2024-24790...

PT-2025-15893

Name of the Vulnerable Software and Affected Versions Yii 2 versions prior to 2.0.52 Description The issue arises from the mishandling of behavior attachment, specifically when behaviors are defined by a class array key. This has been exploited in the wild, with approximately 13,000 vulnerable...

kernel: ext4: fix double-free of blocks due to wrong extents moved_len

A vulnerability was found in the Linux kernel. This issue occurs in the ext4 function, in ext4moveextents, where an error in updating the movedlen variable can lead to double-free of blocks and corrupt block accounting. This could lead to crashes or undefined behavior...

MAL-2024-7836 Malicious code in health-check-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ef9d93b4469df4d458d4c4a226b45fa7baf7760a84cd3d8b5fc84fb990e0e6ba The OpenSSF Package Analysis project identified 'health-check-nodejs' @ 3.16.1 npm as malicious. It is considered malicious because: - The packa...

Moderate: Red Hat Security Advisory: security update Logging for Red Hat OpenShift - 5.9.4

Moderate Logging for Red Hat OpenShift - 5.9.4 Logging for Red Hat OpenShift - 5.9.4 logging-loki-container: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses CVE-2024-24790...

mruby:mruby_proto_fuzzer: Null-dereference READ in ubsan_GetStackTrace

Detailed Report: https://oss-fuzz.com/testcase?key=5180359298318336 Project: mruby Fuzzing Engine: libFuzzer Fuzz Target: mrubyprotofuzzer Job Type: libfuzzerubsanmruby Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: ubsanGetStackTrace Sanitizer:...

openssl's `MemBio::get_buf` has undefined behavior with empty buffers

Previously, MemBio::getbuf called slice::fromrawparts with a null-pointer, which violates the functions invariants, leading to undefined behavior. In debug builds this would produce an assertion failure. This is now fixed...

GHSA-Q445-7M23-QRMW openssl's `MemBio::get_buf` has undefined behavior with empty buffers

Previously, MemBio::getbuf called slice::fromrawparts with a null-pointer, which violates the functions invariants, leading to undefined behavior. In debug builds this would produce an assertion failure. This is now fixed...

MAL-2024-7837 Malicious code in tyibyc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 786311540d56cd996efe5220ccf60e906bf9ba3659372a080971ecf9b2e858dc The OpenSSF Package Analysis project identified 'tyibyc' @ 1.5.31 npm as malicious. It is considered malicious because: - The package executes o...