AZL-28511 CVE-2023-40030 affecting package rust for versions less than 1.72.0-2

Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject nearly arbitrar...

DEBIAN-CVE-2023-40030

Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject nearly arbitrar...

UBUNTU-CVE-2023-40030

Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject nearly arbitrar...

CVE-2023-40030 Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports

Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject nearly arbitrar...

PT-2023-27225 · Rust +4 · Rust +4

Name of the Vulnerable Software and Affected Versions: Rust versions 1.60.0 through 1.71 Description: The issue arises from Cargo not escaping Cargo feature names when including them in the report generated by cargo build --timings. This allows a malicious package included as a dependency to inje...

A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs when a user triggers ioctls such as VIDIOC_S_DV_TIMINGS ioctl. This could allow a local user to crash the system if vivid test code enabled.

...

AZL-13364 CVE-2023-0615 affecting package kernel for versions less than 5.15.122.1-2

A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs when a user triggers ioctls, such as VIDIOCSDVTIMINGS ioctl. This could allow a local user to crash the system if vivid test code enabled...

UBUNTU-CVE-2023-0615

A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs when a user triggers ioctls, such as VIDIOCSDVTIMINGS ioctl. This could allow a local user to crash the system if vivid test code enabled...

GSD-2023-1000325 media: v4l2-dv-timings.c: fix too strict blanking sanity checks

media: v4l2-dv-timings.c: fix too strict blanking sanity checks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.269 by commit...

PT-2023-33125 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v6.0.7 through v6.0.12 Description: The issue is related to too strict blanking sanity checks in the v4l2-dv-timings.c file. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

PT-2023-33225 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.83 Description: The issue concerns too strict blanking sanity checks in the v4l2-dv-timings.c file. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

PT-2023-33402 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 4.19.264 through 4.19.268 Description: The issue is related to too strict blanking sanity checks in the v4l2-dv-timings.c file. The actual impact and attack plausibility have not yet been proven. Recommendations: For Lin...

PT-2024-11852 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue concerns the media component of the Linux kernel, specifically the v4l2-dv-timings.c file. It involves incorrect input validation in the v4l2 valid dv timings function, which...

PT-2022-35080 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: A refcount leak bug was discovered in the of lpddr3 get ddr timings function. The actual impact and attack plausibility of this issue have not yet been proven. Recommendations: For Linux Kern...

PT-2022-35336 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.75 Description: A refcount leak bug was discovered in the of lpddr3 get ddr timings function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2022-35335 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.75 Description: A refcount leak bug was discovered in the of get ddr timings function. The actual impact and attack plausibility of this issue have not yet been proven. Recommendations: For Linux Kernel...

PT-2022-35535 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.150 Description: A refcount leak bug was discovered in the of get ddr timings function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior ...

PT-2022-35084 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v3.7 through v6.0.2 Description: A refcount leak bug was discovered in the of get ddr timings function. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v3.7 and...

PT-2022-35532 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.5 through v5.10.149 Description: A refcount leak bug was found in the of lpddr3 get ddr timings function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

Authentication flaw

PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication attempts...