GHSA-PPM4-R2VC-PG74 SimpleSAMLphp Information Disclosure vulnerability

Background SimpleSAMLphp 1.17 includes a preview of the new user interface to be included in the future version 2.0. This new user interface can be enabled by setting the usenewui configuration option to true, and it includes a new admin interface in a module called admin, which can be disabled...

CVE-2024-30164

Amazon AWS Client VPN has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissions. This is resolved in 3.11.1 on Windows, 3.9.1 on macOS, and 3.12.1 on Linux. NOTE: although the macOS resolution is the same as for CVE-2024-30165, this...

CVE-2024-30164

Amazon AWS Client VPN has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissions. This is resolved in 3.11.1 on Windows, 3.9.1 on macOS, and 3.12.1 on Linux. NOTE: although the macOS resolution is the same as for CVE-2024-30165, this...

SUSE CVE-2021-47391

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Ensure rdmaaddrcancel happens before issuing more requests The FSM can run in a circle allowing rdmaresolveip to be called twice on the same idpriv. While this cannot happen without going through the work, it violates t...

Open Redirect

silverstripe/framework is vulnerable to Open Redirect. The vulnerability is due to using the X-Forwarded-Host HTTP header in place of the actual HTTP hostname, potentially allowing attackers to alter URL resolution resulting in arbitrary redirections...

CVE-2021-47503

In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Do not call scsiremovehost in pm8001alloc Calling scsiremovehost before scsiaddhost results in a crash: BUG: kernel NULL pointer dereference, address: 0000000000000108 RIP: 0010:devicedel+0x63/0x440 Call Trace:...

[SECURITY] Fedora 40 Update: rust-uu_readlink-0.0.23-3.fc40

readlink uutils display resolved path of PATHNAME...

CVE-2021-47557

In the Linux kernel, the following vulnerability has been resolved: net/sched: schets: don't peek at classes beyond 'nbands' when the number of DRR classes decreases, the round-robin active list can contain elements that have already been freed in etsqdiscchange. As a consequence, it's possible t...

CVE-2021-47561

In the Linux kernel, the following vulnerability has been resolved: i2c: virtio: disable timeout handling If a timeout is hit, it can result is incorrect data on the I2C bus and/or memory corruptions in the guest since the device can still be operating on the buffers it was given while the guest...

CVE-2021-47535

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Allocate enough space for GMU registers In commit 142639a52a01 "drm/msm/a6xx: fix crashstate capture for A650" we changed a6xxgetgmuregisters to read 3 sets of registers. Unfortunately, we didn't change the memory...

CVE-2021-47567 powerpc/32: Fix hardlockup on vmap stack overflow

In the Linux kernel, the following vulnerability has been resolved: powerpc/32: Fix hardlockup on vmap stack overflow Since the commit c118c7303ad5 "powerpc/32: Fix vmap stack - Do not activate MMU before reading task struct" a vmap stack overflow results in a hard lockup. This is because...

CVE-2021-47566 proc/vmcore: fix clearing user buffer by properly using clear_user()

In the Linux kernel, the following vulnerability has been resolved: proc/vmcore: fix clearing user buffer by properly using clearuser To clear a user buffer we cannot simply use memset, we have to use clearuser. With a virtio-mem device that registers a vmcorecb and has some logically unplugged...

CVE-2021-47539 rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix rxrpcpeer leak in rxrpclookupbundle Need to call rxrpcputpeer for bundle candidate before kfree as it holds a ref to rxrpcpeer. DH: v2: Changed to abstract out the bundle freeing code into a function...

CVE-2021-47528

In the Linux kernel, the following vulnerability has been resolved: usb: cdnsp: Fix a NULL pointer dereference in cdnspendpointinit In cdnspendpointinit, cdnspringalloc is assigned to pep-ring and there is a dereference of it in cdnspendpointinit, which could lead to a NULL pointer dereference on...

CVE-2021-47516 nfp: Fix memory leak in nfp_cpp_area_cache_add()

In the Linux kernel, the following vulnerability has been resolved: nfp: Fix memory leak in nfpcppareacacheadd In line 800 1, nfpcppareaalloc allocates and initializes a CPP area structure. But in line 807 2, when the cache is allocated failed, this CPP area structure is not freed, which will...

CVE-2021-47515

CVE-2021-47515 affects Linux kernel segmentation with IPv6 SRH encapsulation. When an IPv4 packet is received, the kernel assigns the receiving interface index to IPCB(iif). If that packet is later encapsulated in an outer IPv6+SRH header, seg6_do_srh_encap clears the IPv6 socket state (IP6CB) an...

CVE-2021-47513

In the Linux kernel, the following vulnerability has been resolved: net: dsa: felix: Fix memory leak in felixsetupmmiofiltering Avoid a memory leak if there is not a CPU port defined. Addresses-Coverity-ID: 1492897 "Resource leak" Addresses-Coverity-ID: 1492899 "Resource leak"...

CVE-2021-47510

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix re-dirty process of tree-log nodes There is a report of a transaction abort of -EAGAIN with the following script. !/bin/sh for d in sda sdb; do mkfs.btrfs -d single -m single -f /dev/$d done mount /dev/sda /mnt/test...

CVE-2021-47503

In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Do not call scsiremovehost in pm8001alloc Calling scsiremovehost before scsiaddhost results in a crash: BUG: kernel NULL pointer dereference, address: 0000000000000108 RIP: 0010:devicedel+0x63/0x440 Call Trace:...

GHSA-2HPC-MF4Q-J885 Silverstripe CSRF vulnerability in GridFieldAddExistingAutocompleter

GridField does not have sufficient CSRF protection, meaning that in some cases users with CMS access can be tricked into posting unspecified data into the CMS from external websites. Amongst other default CMS interfaces, GridField is used for management of groups, users and permissions in the CMS...