GHSA-73X5-H92W-XC2J Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding

Summary A normal authenticated user can read the content of a message in a private channel they do not belong to. GET /api/v1/channels/id/messages/messageid/thread authorizes the caller against the URL channel, but the underlying thread lookup loads the thread parent by id and returns it without...

DEBIAN-CVE-2023-53757

In the Linux kernel, the following vulnerability has been resolved: irqchip/irq-mvebu-gicp: Fix refcount leak in mvebugicpprobe ofirqfindparent returns a node pointer with refcount incremented, We should use ofnodeput on it when not needed anymore. Add missing ofnodeput to avoid refcount leak...

CVE-2023-53592 gpio: sifive: Fix refcount leak in sifive_gpio_probe

In the Linux kernel, the following vulnerability has been resolved: gpio: sifive: Fix refcount leak in sifivegpioprobe ofirqfindparent returns a node pointer with refcount incremented, We should use ofnodeput on it when not needed anymore. Add missing ofnodeput to avoid refcount leak...

DEBIAN-CVE-2023-52693

In the Linux kernel, the following vulnerability has been resolved: ACPI: video: check for error while searching for backlight device parent If acpigetparent called in acpivideodevregisterbacklight fails, for example, because acpiutacquiremutex fails inside acpigetparent, this can lead to incorre...