23139 matches found
[ceph] parse_longname(): strrchr() expects NUL-terminated string
...
An issue was discovered in Das U-Boot through 2019.07. There is a read of out-of-bounds data at nfs_read_reply.
...
sched/rt: Fix race in push_rt_task
...
An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
...
bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT
...
drm/amd/display: Disable DMCUB timeout for DCN35
...
wifi: mt76: mt7921s: fix potential hung tasks during chip recovery
...
net: bridge: switchdev: Skip MDB replays of deferred events on offload
...
sysctl: Fix out of bounds access for empty sysctl registers
...
drm/amdgpu: change vm->task_info handling
...
HTACG tidy-html5 alloc.c defaultAlloc memory leak
...
A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128 and Thunderbird < 128.
...
genirq/irq_sim: Initialize work context pointers properly
...
mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()
...
ax25: Remove broken autobind
...
lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure
...
watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
...
lib/generic-radix-tree.c: Don't overflow in peek()
...
scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance
...
ibmvnic: Use kernel helpers for hex dumps
...
ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers
...
net/mlx5: Reload only IB representors upon lag disable/enable
...
jfs: Fix null-ptr-deref in jfs_ioc_trim
...
drm/amd/display: Deallocate DML memory if allocation fails
...
By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.
...
smb: client: fix potential UAF in smb2_is_network_name_deleted()
...
Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
...
drm/amd/display: fix a UBSAN warning in DML2.1
...
An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). The calculations performed by mbedtls_mpi_exp_mod are not limited; thus, supplying overly large parameters could lead to denial of service when generating Diffie-Hellman key pairs.
...
cifs: fix underflow in parse_server_interfaces()
...
RDMA/mlx5: Fix a WARN during dereg_mr for DM type
...
btrfs: do proper folio cleanup when run_delalloc_nocow() failed
...
Parsing issue in protobuf message-type extension
...
netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
...
An issue in wasm2c 1.0.32, wasm2wat 1.0.32, wasm-decompile 1.0.32, and wasm-validate 1.0.32 allows attackers to cause a Denial of Service (DoS) via running a crafted binary.
...
GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in wh
...
An attacker could have caused a use-after-free in the JavaScript engine to read memory in the JavaScript string section of the heap. This vulnerability affects Firefox < 127.
...
Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in privileged code. This vulnerability affects Firefox < 110.
...
smb: client: fix potential UAF in is_valid_oplock_break()
...
ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING"
...
drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini()
...
An issue was discovered in Mbed TLS before 2.24.0. The verification of X.509 certificates when matching the expected common name (the cn argument of mbedtls_x509_crt_verify) with the actual certificate name is mishandled: when the subjecAltName extension is present, the expected name is compared to any name in that extension regardless of its type. This means that an attacker could impersonate a 4-byte or 16-byte domain by getting a certificate for the corresponding IPv4 or IPv6 address (this would require the attacker to control that IP address, though).
...
bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable
...
mm: clear uffd-wp PTE/PMD state on mremap()
...
In Netwide Assembler (NASM) 2.14.02, stack consumption occurs in expr# functions in asm/eval.c. This potentially affects the relationships among expr0, expr1, expr2, expr3, expr4, expr5, and expr6 (and stdscan in asm/stdscan.c). This is similar to CVE-2019-6290 and CVE-2019-6291.
...
Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction
...
If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
...
Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails
...