PT-2022-23872 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinal CMS version 5.1.0 Description: The issue is related to SQL Injection. It is mentioned that certain interfaces in JFinal CMS do not utilize the same component or filters but instead use their own SQL concatenation methods, which results...

GSD-2022-1006227 ext4: fix use-after-free in ext4_xattr_set_entry

ext4: fix use-after-free in ext4xattrsetentry This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.291 by commit...

GSD-2022-1006164 PM: hibernate: defer device probing when resuming from hibernation

PM: hibernate: defer device probing when resuming from hibernation This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.256 by commit...

GSD-2022-1006036 wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd()

wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965rsfilllinkcmd This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.211 by commi...

GSD-2022-1005491 drm/meson: Fix overflow implicit truncation warnings

drm/meson: Fix overflow implicit truncation warnings This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.63 by commit...

PT-2022-33750 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.63 Description: The issue is related to an overflow implicit truncation warning in the irqchip/tegra component. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linu...

PT-2022-33991 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.141 Description: The issue concerns a NULL pointer dereference in the steam recv report and steam send report functions. This problem was introduced in version v4.18 and is fixed in version v5.10.141. The...

PT-2022-33812 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.61 Description: The issue concerns a stack-out-of-bound access in SPMI tracing functions. It was introduced in version v4.3 and fixed in Linux Kernel version v5.15.61. The actual impact and attack...

PT-2022-33847 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.61 Description: The issue is related to the incorrect clearing of the interrupt status register in RDMA/hns. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

GSD-2022-1005457 venus: pm_helpers: Fix warning in OPP during probe

venus: pmhelpers: Fix warning in OPP during probe This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.63 by commit...

GSD-2022-1005453 netfilter: flowtable: fix stuck flows on cleanup due to pending work

netfilter: flowtable: fix stuck flows on cleanup due to pending work This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.64 by commit...

GSD-2022-1005245 KVM: s390: pv: leak the topmost page table when destroy fails

KVM: s390: pv: leak the topmost page table when destroy fails This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.2 by commit...

GSD-2022-1005172 Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression

Bluetooth: L2CAP: Fix l2capglobalchanbypsm regression This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.2 by commit...

GSD-2022-1005050 netfilter: flowtable: fix stuck flows on cleanup due to pending work

netfilter: flowtable: fix stuck flows on cleanup due to pending work This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.6 by commit...

CVE-2022-35999

TensorFlow is an open source platform for machine learning. When Conv2DBackpropInput receives empty outbackprop inputs e.g. 3, 1, 0, 1, the current CPU/GPU kernels CHECK fail one with dnnl, the other with cudnn. This can be used to trigger a denial of service attack. We have patched the issue in...

CVE-2022-35992 `CHECK` fail in `TensorListFromTensor` in TensorFlow

TensorFlow is an open source platform for machine learning. When TensorListFromTensor receives an elementshape of a rank greater than one, it gives a CHECK fail that can trigger a denial of service attack. We have patched the issue in GitHub commit 3db59a042a38f4338aa207922fa2f476e000a6ee. The fi...

CVE-2022-36005 `CHECK` fail in `FakeQuantWithMinMaxVarsGradient` in TensorFlow

TensorFlow is an open source platform for machine learning. When tf.quantization.fakequantwithminmaxvarsgradient receives input min or max that is nonscalar, it gives a CHECK fail that can trigger a denial of service attack. We have patched the issue in GitHub commit...

TensorFlow vulnerable to integer overflow in math ops

Impact When RangeSize receives values that do not fit into an int64t, it crashes. cpp auto size = std::isintegral::value ? Eigen::numext::abslimit - start + Eigen::numext::absdelta - T1 / Eigen::numext::absdelta : Eigen::numext::ceil Eigen::numext::abslimit - start / delta; // This check does not...

MGASA-2022-0327 Updated dpkg packages fix security vulnerability

A malicious source package could write files outside the unpack directory. CVE-2022-1664...

Updated libtar packages fix security vulnerability

An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc0 for a variable gnulonglink, causing an out-of-bounds read. CVE-2021-33643 An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger...