CVE-2025-37879

CVE-2025-37879 affects the Linux kernel 9p/net component. Root cause: in p9_client_write() and p9_client_read_once(), a server could reply with success but a negative count due to signed variable handling, leading to incorrect conclusions about written/read data. The documented fix is to convert ...

CVE-2025-37879 9p/net: fix improper handling of bogus negative read/write replies

In the Linux kernel, the following vulnerability has been resolved: 9p/net: fix improper handling of bogus negative read/write replies In p9clientwrite and p9clientreadonce, if the server incorrectly replies with success but a negative write/read count then we would consider written negative 3...

CVE-2025-37879 9p/net: fix improper handling of bogus negative read/write replies

In the Linux kernel, the following vulnerability has been resolved: 9p/net: fix improper handling of bogus negative read/write replies In p9clientwrite and p9clientreadonce, if the server incorrectly replies with success but a negative write/read count then we would consider written negative 3...

CVE-2025-37859

The CVE-2025-37859 issue affects the Linux kernel page_pool subsystem. The root cause was a bug where page_pool_release_retry() could wake up the kworker repeatedly when inflight became negative, causing an infinite reschedule loop and flooding logs. The published fix mitigates this by not resche...

CVE-2025-37859 page_pool: avoid infinite loop to schedule delayed worker

In the Linux kernel, the following vulnerability has been resolved: pagepool: avoid infinite loop to schedule delayed worker We noticed the kworker in pagepoolreleaseretry was waken up repeatedly and infinitely in production because of the buggy driver causing the inflight less than 0 and warning...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from not properly handling read and write replies to negative numbers, which could lead to an integer overflow...

CVE-2025-3889

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the 'processpaymentdata' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the...

SUSE CVE-2023-53040

In the Linux kernel, the following vulnerability has been resolved: ca8210: fix maclen negative array access This patch fixes a buffer overflow access of skb-data if ieee802154hdrpeekaddrs fails...

DEBIAN-CVE-2023-53040

In the Linux kernel, the following vulnerability has been resolved: ca8210: fix maclen negative array access This patch fixes a buffer overflow access of skb-data if ieee802154hdrpeekaddrs fails...

UBUNTU-CVE-2023-53040

In the Linux kernel, the following vulnerability has been resolved: ca8210: fix maclen negative array access This patch fixes a buffer overflow access of skb-data if ieee802154hdrpeekaddrs fails...

CVE-2023-53040 ca8210: fix mac_len negative array access

In the Linux kernel, the following vulnerability has been resolved: ca8210: fix maclen negative array access This patch fixes a buffer overflow access of skb-data if ieee802154hdrpeekaddrs fails...

DEBIAN-CVE-2022-49862

In the Linux kernel, the following vulnerability has been resolved: tipc: fix the msg-req tlv len check in tipcnlcompatnametabledumpheader This is a follow-up for commit 974cb0e3e7c9 "tipc: fix uninit-value in tipcnlcompatnametabledump" where it should have type casted sizeof.. to int to work whe...

UBUNTU-CVE-2022-49862

In the Linux kernel, the following vulnerability has been resolved: tipc: fix the msg-req tlv len check in tipcnlcompatnametabledumpheader This is a follow-up for commit 974cb0e3e7c9 "tipc: fix uninit-value in tipcnlcompatnametabledump" where it should have type casted sizeof.. to int to work whe...

CVE-2022-49862 tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header

In the Linux kernel, the following vulnerability has been resolved: tipc: fix the msg-req tlv len check in tipcnlcompatnametabledumpheader This is a follow-up for commit 974cb0e3e7c9 "tipc: fix uninit-value in tipcnlcompatnametabledump" where it should have type casted sizeof.. to int to work whe...

CVE-2025-3889

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the 'processpaymentdata' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the...

CVE-2025-3889 WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference via 'quantity'

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the 'processpaymentdata' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the...

CVE-2025-3889

CVE-2025-3889 affects WordPress Simple Shopping Cart (WordPress plugin) up to version 5.1.3, via Insecure Direct Object Reference in process_payment_data. Unauthenticated attackers can set a product quantity to a negative value, subtracting cost from the total, and the attack is only effective in...

PT-2025-18383 · WordPress · Wordpress Simple Shopping Cart

Name of the Vulnerable Software and Affected Versions: WordPress Simple Shopping Cart plugin versions up to, and including, 5.1.3 Description: The issue allows unauthenticated attackers to manipulate the quantity of a product to a negative number, effectively subtracting the product cost from the...

Amazon Linux 2 : firefox (ALASFIREFOX-2025-037)

The version of firefox installed on the remote host is prior to 128.9.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2025-037 advisory. An issue was discovered in libexpat before 2.6.4. There is a crash within the XMLResumeParser function because...

OSV-2025-300 Negative-size-param in recurse_update_offsets

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=413078692 Crash type: Negative-size-param Crash state: recurseupdateoffsets match pcre2match8...