CVE-2023-53851

CVE-2023-53851 (Linux kernel) affects drm/msm/dp, where dropping aux devices along with the DP controller caused a use-after-free in DP resources when probe deferral happens. The root cause is the devres-based depopulation of the aux bus tying to a DPU device (drm_dev->dev), which may outlive ...

UBUNTU-CVE-2023-53793

In the Linux kernel, the following vulnerability has been resolved: perf tool x86: Fix perfenv memory leak Found by leak sanitizer: ==1632594==ERROR: LeakSanitizer: detected memory leaks Direct leak of 21 bytes in 1 objects allocated from: 0 0x7f2953a7077b in interceptorstrdup...

SUSE CVE-2022-50616

In the Linux kernel, the following vulnerability has been resolved: regulator: core: Use different devices for resource allocation and DT lookup Following by the below discussion, there's the potential UAF issue between regulator and mfd...

CVE-2023-53789 iommu/amd: Improve page fault error reporting

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Improve page fault error reporting If IOMMU domain for device group is not setup properly then we may hit IOMMU page fault. Current page fault handler assumes that domain is always setup and it will hit NULL pointer...

CVE-2023-53789

In CVE-2023-53789, the Linux kernel vulnerability stems from IOMMU page fault handling when an IOMMU domain for a device group is not properly set up, risking a NULL pointer dereference. The available connected sources (EUVD-2023-60117, NVD, Debian/Ubuntu OSV entries, OSV, and other trackers) des...

CVE-2023-53785

In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: don't assume adequate headroom for SDIO headers mt7921usbsdiotxprepareskb calls mt7921usbsdiowritetxwi and mt7921skbaddusbsdiohdr, both of which blindly assume that adequate headroom will be available in the passed...

PT-2025-49841

A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X All versions V5.10.1, RUGGEDCOM RS416Pv2 V5.X All versions V5.10.1, RUGGEDCOM RS416v2 V5.X All versions V5.10.1, RUGGEDCOM RS900 32M V5.X All versions V5.10.1, RUGGEDCOM RS900G 32M V5.X All versions V5.10.1, RUGGEDCOM RSG2100 32M V5.X...

Amazon Linux 2023 : amd-ucode-firmware, iwl100-firmware, iwl105-firmware (ALAS2023-2025-1307)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1307 advisory. Improper isolation of shared resources on a system on a chip by a malicious local attacker with high privileges could potentially lead to a partial loss of integrity. CVE-2025-54514 Improper...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from openvswitch not validating a negative ifindex value, which could lead to the creation of invalid network...

CVE-2025-14136

A security flaw has been discovered in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function RE2000v2RepeatergetwiredclientlistsetClientsName of the file modform.so. The manipulation of the argume...

CVE-2025-14224

A vulnerability was found in Yottamaster DM2, DM3 and DM200 up to 1.2.23/1.9.12. Affected by this issue is some unknown functionality of the component File Upload. Performing manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been made public an...

CVE-2025-14225

The CVE-2025-14225 entry concerns D-Link DCS-930L (firmware 1.15.04) and the alphapd component, where manipulating the AdminID parameter in /setSystemAdmin can yield remote command execution. Public disclosures exist, and the affected products are no longer supported by the maintainer. Several co...

CVE-2025-14224 Yottamaster DM2/DM3/DM200 File Upload path traversal

A vulnerability was found in Yottamaster DM2, DM3 and DM200 up to 1.2.23/1.9.12. Affected by this issue is some unknown functionality of the component File Upload. Performing manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been made public an...

A week in security (December 1 – December 7)

Last week on Malwarebytes Labs: Leaks show Intellexa burning zero-days to keep Predator spyware running How scammers use fake insurance texts to steal your identity Canadian police trialing facial recognition bodycams Update Chrome now: Google fixes 13 security issues affecting billions Attackers...

CVE-2023-53755

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ptdma: check for null desc before calling ptcmdcallback Resolves a panic that can occur on AMD systems, typically during host shutdown, after the PTDMA driver had been exercised. The issue was the ptissuepending functi...

CVE-2023-53755

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ptdma: check for null desc before calling ptcmdcallback Resolves a panic that can occur on AMD systems, typically during host shutdown, after the PTDMA driver had been exercised. The issue was the ptissuepending functi...

CVE-2022-50616

CVE-2022-50616 relates to the Linux kernel regulator core: a design issue where init data could be allocated on the wrong device due to DT lookups during regulator initialization, creating a potential use-after-free (UAF) when a parent device is released while the regulator core still accesses in...

CVE-2025-65363

Authenticated append-style command-injection Ruijie APs APRGOS 11.1.x allows an authenticated web user to execute appended shell expressions as root, enabling file disclosure, device disruption, and potential network pivoting via the command parameter to the webaction.do endpoint...

The vulnerability of the Android operating system library libimagecodec.quram.so in Samsung mobile devices allows a hacker to execute arbitrary code.

The vulnerability of the Android operating system’s libimagecodec.quram.so library in Samsung mobile devices is related to writing beyond the buffer boundaries of memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the ndo_open() function in the drivers/net/usb/asix_devices.c module of the USB device support driver for the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the ndoopen function in the drivers/net/usb/asixdevices.c module of the Linux USB device driver framework is related to synchronization errors when using shared resources „Race Conditions“. Exploiting this vulnerability can allow an attacker to cause service failures remotely...