13863 matches found
PT-2025-13564 · Xfig +4 · Xfig +4
Name of the Vulnerable Software and Affected Versions: xfig version 3.2.9a Description: The issue is related to a heap-buffer overflow in the fig2dev component, specifically affecting the create line with spline function. This allows an attacker to impact availability via local input manipulation...
USN-7386-1 linux-oem-6.8 vulnerabilities
Michael Randrianantenaina discovered that the Bluetooth driver in the Linux Kernel contained an improper access control vulnerability. A nearby attacker could use this to connect a rougue device and possibly execute arbitrary code. CVE-2024-8805 Attila Szász discovered that the HFS+ file system...
CVE-2023-53025
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2023-53021
In the Linux kernel, the following vulnerability has been resolved: net/sched: schtaprio: fix possible use-after-free syzbot reported a nasty crash 1 in nettxaction which made little sense until we got a repro. This repro installs a taprio qdisc, but providing an invalid TCARATE attribute...
CVE-2023-53023
In the Linux kernel, the following vulnerability has been resolved: net: nfc: Fix use-after-free in localcleanup Fix a use-after-free that occurs in kfreeskb called from localcleanup. This could happen when killing nfc daemon e.g. neard after detaching an nfc device. When detaching an nfc device,...
CVE-2023-53014
In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra: Fix memory leak in terminateall Terminate vdesc when terminating an ongoing transfer. This will ensure that the vdesc is present in the descterminated list The descriptor will be freed later in descfreelist. Thi...
CVE-2023-52999
In the Linux kernel, the following vulnerability has been resolved: net: fix UaF in netns ops registration error path If netassigngeneric fails, the current error path in opsinit tries to clear the gen pointer slot. Anyway, in such error path, the gen pointer itself has not been modified yet, and...
CVE-2023-53001
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2023-52991
In the Linux kernel, the following vulnerability has been resolved: net: fix NULL pointer in skbsegmentlist Commit 3a1296a38d0c "net: Support GRO/GSO fraglist chaining." introduced UDP listifyed GRO. The segmentation relies on fraglist being untouched when passing through the network stack. This...
CVE-2022-49744
In the Linux kernel, the following vulnerability has been resolved: mm/uffd: fix pte marker when fork without fork event Patch series "mm: Fixes on pte markers". Patch 1 resolves the syzkiller report from Pengfei. Patch 2 further harden pte markers when used with the recent swapin error markers...
CVE-2022-49746
In the Linux kernel, the following vulnerability has been resolved: dmaengine: imx-sdma: Fix a possible memory leak in sdmatransferinit If the function sdmaloadcontext fails, the sdmadesc will be freed, but the allocated desc-bd is forgot to be freed. We already met the sdmaloadcontext failure ca...
UBUNTU-CVE-2023-52975
In the Linux kernel, the following vulnerability has been resolved: scsi: iscsitcp: Fix UAF during logout when accessing the shost ipaddress Bug report and analysis from Ding Hui. During iSCSI session logout, if another task accesses the shost ipaddress attr, we can get a KASAN UAF report like...
UBUNTU-CVE-2023-52939
In the Linux kernel, the following vulnerability has been resolved: mm: memcg: fix NULL pointer in memcgrouptrackforeigndirtyslowpath As commit 18365225f044 "hwpoison, memcg: forcibly uncharge LRU pages", hwpoison will forcibly uncharg a LRU hwpoisoned page, the foliomemcg could be NULl, then,...
CVE-2023-53033
Summary (CVE-2023-53033): The Linux kernel netfilter NFT payload code incorrectly handles VLAN header bit extraction due to arithmetic that adds, not subtracts, the VLAN header size when computing the copy length for double-tagged packets. This could permit out-of-bounds handling in VLAN header p...
CVE-2023-53026
CVE-2023-53026 — Linux kernel RDMA/core overflow in ib block iterator . The issue occurs when registering a DMA memory region (MR) after choosing a best-aligned page size, while iterating the sglist to split entries into DMA blocks. If the sg entry size and page size match in a way that the total...
CVE-2023-53014
In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra: Fix memory leak in terminateall Terminate vdesc when terminating an ongoing transfer. This will ensure that the vdesc is present in the descterminated list The descriptor will be freed later in descfreelist. Thi...
CVE-2023-53012
CVE-2023-53012 is documented across multiple connected advisories as a Linux kernel vulnerability affecting the thermal subsystem. The issue arises from calling put_device() before a successful device_register(), specifically in __thermal_cooling_device_register(), and is accompanied by unnecessa...
CVE-2023-53007
The CVE-2023-53007 issue affects the Linux kernel tracing path, specifically trace_printk(): the vulnerability arises because trace_printk() can be used before the ftrace events are fully registered, leading to missing trace output after a crash if ftrace_dump_on_oops is enabled. The fix register...
CVE-2023-53006
The CVE-2023-53006 issue is a Linux kernel CIFS (smbd) reconnect bug. The root cause is an uncleared server->smbd_conn pointer in reconnection logic, which can lead to oops if reconnection occurs after the smbd_connection struct is freed. The connected advisories describe that in smbd_destroy(...