CVE-2022-38880

The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The affected version is 0.1.0...

kernel security update

2.6.32-754.35.1.0.7.OL6 - bluetooth: eliminate the potential race condition when removing the HCI controller Lin Ma CVE-2021-32399 Orabug: 33763116 - RDMA/ucma: Put a lock around every call to the rdmacm layer Jason Gunthorpe Orabug: 33763116 - RDMA/cma: Add missing locking to rdmaaccept Leon...

CVE-2022-40468

CVE-2022-40468 affects tinyproxy. The issue is a potential leak of left-over heap data when using custom error page templates with non-standard variables, caused by uninitialized buffers in process_request() and related header handling. Multiple advisories confirm risk across distros, including D...

[NAZ-M3] Use safeTransferFrom() instead of transferFrom() for ERC721 transfers

Lines of code Vulnerability details Impact The transferFrom method is used instead of safeTransferFrom, presumably to save gas. I however argue that this isn’t recommended because: OpenZeppelin’s documentation discourages the use of transferFrom, use safeTransferFrom whenever possible. Given that...

Ruby on Rails: Unexpected deserialization in Kredis

Unexpected classes could be deserialized in Kredis due to the use of JSON.load, potentially leading to security vulnerabilities...

GSD-2022-1006292 ALSA: timer: Use deferred fasync helper

ALSA: timer: Use deferred fasync helper This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.326 by commit...

GSD-2022-1006284 fbdev: fb_pm2fb: Avoid potential divide by zero error

fbdev: fbpm2fb: Avoid potential divide by zero error This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.327 by commit...

GSD-2022-1006259 i2c: Fix a potential use after free

i2c: Fix a potential use after free This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.291 by commit e6412ba3b6508bdf9c074d310bf4144afa6aec1a...

GSD-2022-1006257 wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd()

wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965rsfilllinkcmd This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.291 by comm...

GSD-2022-1006251 mtd: maps: Fix refcount leak in ap_flash_init

mtd: maps: Fix refcount leak in apflashinit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.291 by commit...

GSD-2022-1006207 kprobes: don't call disarm_kprobe() for disabled kprobes

kprobes: don't call disarmkprobe for disabled kprobes This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.292 by commit...

GSD-2022-1006191 fbdev: fb_pm2fb: Avoid potential divide by zero error

fbdev: fbpm2fb: Avoid potential divide by zero error This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.292 by commit...

GSD-2022-1006180 btrfs: reject log replay if there is unsupported RO compat flag

btrfs: reject log replay if there is unsupported RO compat flag This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.256 by commit...

GSD-2022-1006173 ARM: OMAP2+: Fix refcount leak in omap3xxx_prm_late_init

ARM: OMAP2+: Fix refcount leak in omap3xxxprmlateinit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.256 by commit...

GSD-2022-1006166 drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()

drm/radeon: fix potential buffer overflow in nisetmcspecialregisters This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.256 by commit...

GSD-2022-1006162 i2c: Fix a potential use after free

i2c: Fix a potential use after free This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.256 by commit 23a191b132cd87f746c62f3dc27da33683d85829...

GSD-2022-1006145 RDMA/hfi1: fix potential memory leak in setup_base_ctxt()

RDMA/hfi1: fix potential memory leak in setupbasectxt This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.256 by commit...

GSD-2022-1006127 tee: add overflow check in register_shm_helper()

tee: add overflow check in registershmhelper This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.256 by commit...

GSD-2022-1006107 clk: qcom: ipq8074: dont disable gcc_sleep_clk_src

clk: qcom: ipq8074: dont disable gccsleepclksrc This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.256 by commit...

GSD-2022-1006106 gadgetfs: ep_io - wait until IRQ finishes

gadgetfs: epio - wait until IRQ finishes This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.256 by commit...