9721 matches found
kernel: wifi: ath10k: Delay the unmapping of the buffer
In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: Delay the unmapping of the buffer On WCN3990, we are seeing a rare scenario where copy engine hardware is sending a copy complete interrupt to the host driver while still processing the buffer that the driver has...
kernel: drm/amdkfd: Fix an illegal memory access
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix an illegal memory access In the kfdwaitonevents function, the kfdeventwaiter structure is allocated by alloceventwaiters, but the event field of the waiter structure is not initialized; When copyfromuser fails in...
kernel: drm: Prevent drm_copy_field() to attempt copying a NULL pointer
A NULL pointer dereference flaw was found in the Linux kernel's DRM subsystem. When a graphics driver incorrectly fails to initialize required fields in the drmdriver structure, the drmcopyfield function attempts to copy from a NULL pointer when handling the DRMIOCTLVERSION ioctl, causing a kerne...
kernel: wifi: rtw88: use work to update rate to avoid RCU warning
A flaw was identified in the Linux kernel’s rtw88 Wi-Fi driver drivers/net/wireless/realtek/rtw88 where the ieee80211ops::starcupdate callback was invoked within a Read-Copy-Update RCU read-side critical section without proper atomicity or deferral. The ieee80211chanbwchange function holds an RCU...
kernel: net/mlx5e: Fix deadlock in tc route query code
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix deadlock in tc route query code Cited commit causes ABBA deadlock0 when peer flows are created while holding the devcom rw semaphore. Due to peer flows offload implementation the lock is taken much higher up the ca...
kernel: drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl()
A memory leak vulnerability was found in the VMware graphics driver vmwgfx in the Linux kernel. In vmwmksstataddioctl, when copying the description string from userspace fails with -EFAULT, the allocated page for the instance descriptor is not freed. This leads to memory leakage that can cause...
kernel: scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Prevent lpfcdebugfslockstatwrite buffer overflow A static code analysis tool flagged the possibility of buffer overflow when using copyfromuser for a debugfs entry. Currently, it is possible that copyfromuser copies...
The vulnerability of the XkbCopyNames function in the Wayland protocol for X.Org XWayland, which is part of the X.Org Server, allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.
The vulnerability of the XkbCopyNames function in the Wayland protocol for X.Org XWayland, which is part of the X.Org Server for the X Window System, relates to the use of memory after it is freed. Exploiting this vulnerability allows a perpetrator to access confidential data, compromise its...
CVE-2023-47801
An issue was discovered in Click Studios Passwordstate before 9811. Existing users Security Administrators could use the System Wide API Key to read or delete private password records when specifically used with the PasswordHistory API endpoint. It is also possible to use the Copy/Move Password...
CVE-2023-47801
An issue was discovered in Click Studios Passwordstate before 9811. Existing users Security Administrators could use the System Wide API Key to read or delete private password records when specifically used with the PasswordHistory API endpoint. It is also possible to use the Copy/Move Password...
mariadb: server crash in JOIN_CACHE::free or in copy_fields
MariaDB v10.7 was discovered to contain an use-after-poison in in interceptormemset at /libsanitizer/sanitizercommon/sanitizercommoninterceptors.inc...
The vulnerability of the devn_pcx_write_rle() function in the base/gdevdevn.c component of the Ghostscript document processing software allows a hacker to cause a service failure.
The vulnerability of the devnpcxwriterle function in the base/gdevdevn.c file of the Ghostscript document processing software is related to the copying of buffers without checking the input data. Exploiting this vulnerability could allow an attacker to cause a service failure using a specially...
CVE-2023-47610
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists in Telit Cinterion EHS5/6/8 that could allow a remote unauthenticated attacker to execute arbitrary code on the targeted system by sending a specially crafted SMS message...
Design/Logic Flaw
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a remote unauthenticated attacker to execute arbitrary code on the targeted syst...
CVE-2023-47610
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists in Telit Cinterion EHS5/6/8 that could allow a remote unauthenticated attacker to execute arbitrary code on the targeted system by sending a specially crafted SMS message...
CVE-2023-47610
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists in Telit Cinterion EHS5/6/8 that could allow a remote unauthenticated attacker to execute arbitrary code on the targeted system by sending a specially crafted SMS message...
Telit Cinterion BGS5 Security Vulnerability
Telit Cinterion EHS5/6/8 is an edge device module from Telit Cinterion. A security vulnerability exists in the Telit Cinterion BGS5 that stems from the presence of a buffer copy vulnerability that does not check the input size, which could allow a remote, unauthenticated attacker to execute...
mariadb: server crash in JOIN_CACHE::free or in copy_fields
MariaDB v10.7 was discovered to contain an use-after-poison in in interceptormemset at /libsanitizer/sanitizercommon/sanitizercommoninterceptors.inc...
xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty
A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing f...
CVE-2023-41112
An issue was discovered in Samsung Mobile Processor, Wearable Processor, Automotive Processor, and Modem Exynos 9810, 9610, 9820, 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, 9110, W920, Modem 5123, Modem 5300, and Auto T5123. A buffer copy, without checking the size of the input, can cause...