CVE-2022-49223 cxl/port: Hold port reference until decoder release

In the Linux kernel, the following vulnerability has been resolved: cxl/port: Hold port reference until decoder release KASAN + DEBUGKOBJECTRELEASE reports a potential use-after-free in cxldecoderrelease where it goes to reference its parent, a cxlport, to free its id back to port-decoderida. BUG...

CVE-2022-49211 mips: cdmm: Fix refcount leak in mips_cdmm_phys_base

In the Linux kernel, the following vulnerability has been resolved: mips: cdmm: Fix refcount leak in mipscdmmphysbase The offindcompatiblenode function returns a node pointer with refcount incremented, We should use ofnodeput on it when done Add the missing ofnodeput to release the refcount...

CVE-2022-49202

CVE-2022-49202 concerns a missing NULL check in Linux kernel Bluetooth hci_uart path (h5_enqueue), where a Syzbot general protection fault occurred in __pm_runtime_resume() due to blindly passing a possibly NULL serdev pointer (hu->serdev). The issue could lead to GPF if hu->serdev is NULL....

CVE-2022-49178

In the Linux kernel, the following vulnerability has been resolved: memstick/msproblock: fix handling of read-only devices Use setdiskro to propagate the read-only state to the block layer instead of checking for it in -open and leaking a reference in case of a read-only device...

CVE-2022-49170

CVE-2022-49170 concerns the F2FS implementation in the Linux kernel. The root cause was a missing sanity check on curseg->alloc_type, which could widen an array-bounds access of sbi->block_count[] (UBSAN: array-index-out-of-bounds) when mounting/operating a corrupted image. The issue manife...

CVE-2022-49153 wireguard: socket: free skb in send6 when ipv6 is disabled

In the Linux kernel, the following vulnerability has been resolved: wireguard: socket: free skb in send6 when ipv6 is disabled I got a memory leak report: unreferenced object 0xffff8881191fc040 size 232: comm "kworker/u17:0", pid 23193, jiffies 4295238848 age 3464.870s hex dump first 32 bytes: 00...

CVE-2022-49149

The CVE-2022-49149 issue affects the Linux kernel rxrpc subsystem where a timer for a call could be started while the call is being destroyed (softirq context with only the RCU read lock). This race could cause the timer (already stopped) to be restarted and, later, the timer dispatcher may oops ...

CVE-2022-49144 io_uring: fix memory leak of uid in files registration

In the Linux kernel, the following vulnerability has been resolved: iouring: fix memory leak of uid in files registration When there are no files for iosqefilesscm to process in the range, it'll free everything and return. However, it forgets to put uid...

CVE-2022-49136 Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix queuing commands when HCIUNREGISTER is set hcicmdsyncqueue shall return an error if HCIUNREGISTER flag has been set as that means hciunregisterdev has been called so it will likely cause a uaf after the...

CVE-2022-49080 mm/mempolicy: fix mpol_new leak in shared_policy_replace

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix mpolnew leak in sharedpolicyreplace If mpolnew is allocated but not used in restart loop, mpolnew will be freed via mpolput before returning to the caller. But refcnt is not initialized yet, so mpolput could not...

CVE-2022-49058

In the Linux kernel, the following vulnerability has been resolved: cifs: potential buffer overflow in handling symlinks Smatch printed a warning: arch/x86/crypto/poly1305glue.c:198 poly1305updatearch error: memcpy 'dctx-buf' too small 16 vs u32max It's caused because Smatch marks 'linklen' as...

CVE-2022-49044

CVE-2022-49044 affects the Linux kernel dm‑integrity driver. When tag_size is smaller than the digest size, a portion of the digest is written beyond the end of ic->recalc_tags, corrupting memory in integrity_recalc->integrity_sector_checksum->crypto_shash_final. The fix increases the ta...

CVE-2021-47642

In the Linux kernel, the following vulnerability has been resolved: video: fbdev: nvidiafb: Use strscpy to prevent buffer overflow Coverity complains of a possible buffer overflow. However, given the 'static' scope of nvidiasetupi2cbus it looks like that can't happen after examiniing the call...

CVE-2021-47642 video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow

In the Linux kernel, the following vulnerability has been resolved: video: fbdev: nvidiafb: Use strscpy to prevent buffer overflow Coverity complains of a possible buffer overflow. However, given the 'static' scope of nvidiasetupi2cbus it looks like that can't happen after examiniing the call...

CVE-2021-47635

CVE-2021-47635 concerns a Linux kernel ubifs page refcount bug when a page is marked with PG_private. The connected documents describe that UBIFS did not increase the page’s refcount after SetPagePrivate, causing the migration code to overestimate zero references and migrate pages still in use, p...

[slackware-security] xorg-server

New xorg-server packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/xorg-server-1.20.14-i586-15slack15.0.txz: Rebuilt. This update fixes security issues: Use-after-free of the root cursor. Buffer...

CVE-2025-27110

Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurit...

CVE-2025-27110 Libmodsecurity3 has possible bypass of encoded HTML entities

Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurit...

CVE-2025-21627

GLPI is a free asset and IT management software package. In versions prior to 10.0.18, a malicious link can be crafted to perform a reflected XSS attack on the search page. If the anonymous ticket creation is enabled, this attack can be performed by an unauthenticated user. Version 10.0.18 contai...

CVE-2025-21626 GLPI vulnerable to exposure of sensitive information in the `status.php` endpoint

GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive information from the status.php endpoint. Version 10.0.18 contains a fix for the issue. Some workarounds are available. One may delete the status.p...