Vikunja: Cross-project task disclosure through subtask expansion

Summary Vikunja lets a task in one project have a subtask that lives in a different project. When listing a project's tasks, an option pulls in those subtasks ?expand%5B%5D=subtasks. The main listing is correctly filtered to the projects the caller can access, but the subtask expansion is not: it...

GHSA-3HC7-R24J-RPWC Vikunja: Cross-project task disclosure through subtask expansion

Summary Vikunja lets a task in one project have a subtask that lives in a different project. When listing a project's tasks, an option pulls in those subtasks ?expand%5B%5D=subtasks. The main listing is correctly filtered to the projects the caller can access, but the subtask expansion is not: it...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: i40e: Fixed a use-after-free in i40eclientsubtask. Currently, the call to i40eclientdelinstance frees the object pf-cinst. However, pf-cinst-laninfo is accessed after the object is freed. This issue was fixed by adding the...

Linux i40e_client_subtask Heap Buffer Overflow DoS

The vulnerability of the i40eclientsubtask function in the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure...

SUSE CVE-2021-46991

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix use-after-free in i40eclientsubtask Currently the call to i40eclientdelinstance frees the object pf-cinst, however pf-cinst-laninfo is being accessed after the free. Fix this by adding the missing return...

DEBIAN-CVE-2021-46991

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix use-after-free in i40eclientsubtask Currently the call to i40eclientdelinstance frees the object pf-cinst, however pf-cinst-laninfo is being accessed after the free. Fix this by adding the missing return...

UBUNTU-CVE-2021-46991

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix use-after-free in i40eclientsubtask Currently the call to i40eclientdelinstance frees the object pf-cinst, however pf-cinst-laninfo is being accessed after the free. Fix this by adding the missing return...

Linux kernel security vulnerabilities

The Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. A security vulnerability exists in the Linux kernel that stems from a post-release reuse in i40eclientsubtask...

PT-2024-10332 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a use-after-free vulnerability in the i40e client subtask function. This vulnerability occurs because the object pf-cinst is freed by the call to i40e client de...

PT-2021-28875

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.120 Description The issue is related to a use-after-free in the i40e client subtask function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions pri...

PT-2021-28911

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.191 Description A use-after-free issue exists in the i40e client subtask function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2021-24675

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v4.16 through v5.12.4 Description The issue is related to a use-after-free in the i40e client subtask function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2021-28669

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.12.5 Description The issue is related to a use-after-free in the i40e client subtask function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prio...

PT-2021-28788

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.38 Description The issue is related to a use-after-free in the i40e client subtask function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions pri...

PT-2021-24881

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.120 Description: The issue is related to a use-after-free in the i40e client subtask function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2021-24917

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.191 Description: The issue is related to a use-after-free in the i40e client subtask function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2021-24794

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.38 Description The issue is related to a use-after-free in the i40e client subtask function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions pri...

Moving a subtask Issue Type will sometimes ask the user for a Security Level even though this value is inherited from the Parent Issue.

When you move a subtask from an Issue Type where Security Level is a hidden field, to one where Security Level is no longer hidden, the system can mistakenly ask the User for a new Security Level. This is only a minor issue, as then the subtask will not actually take on the chosen value - it will...

Moving a subtask Issue Type will sometimes ask the user for a Security Level even though this value is inherited from the Parent Issue.

When you move a subtask from an Issue Type where Security Level is a hidden field, to one where Security Level is no longer hidden, the system can mistakenly ask the User for a new Security Level. This is only a minor issue, as then the subtask will not actually take on the chosen value - it will...

Moving a subtask Issue Type will sometimes ask the user for a Security Level even though this value is inherited from the Parent Issue.

When you move a subtask from an Issue Type where Security Level is a hidden field, to one where Security Level is no longer hidden, the system can mistakenly ask the User for a new Security Level. This is only a minor issue, as then the subtask will not actually take on the chosen value - it will...