33476 matches found
nfc: llcp: reject PDUs shorter than the LLCP header
...
ext4: stop retrying saturated xattr cache entries
...
HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
...
ext4: don't enable DAX on new encrypted files
...
mptcp: pm: fix memory leak from alloc-during-teardown race
...
Bluetooth: hci_event: validate LE Set CIG Parameters response
...
HID: pidff: fix OOB write when hid->inputs is empty
...
USB: serial: option: fix slab OOB read in interrupt URB callback
...
sctp: reject stale cookies with mismatched verification tags
...
usb: xhci: bail out of setup if the controller is inaccessible
...
drm/amdgpu: Reject UVD message with invalid number of h265 refs
...
Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
...
net: tap: fix wrong transport_header when sending VLAN-tagged frame
...
ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
...
RDMA/rxe: Fix OOB in free_rd_atomic_resources()
...
HID: hyperv: validate initial device info bounds
...
USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
...
mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
...
nvmet-auth: zero the AUTH_RECEIVE response buffer
...
HID: magicmouse: do not keep a stale msc->input if no input is claimed
...
nfc: llcp: bound the connect_sn TLV walk to the skb
...
Bluetooth: ISO: zero the sockaddr before returning it in getname
...
HID: nintendo: stop device IO before hid_hw_stop on probe failure
...
tcp: clamp route advmss to TCP_MIN_MSS
...
nvmet-fc: fix invalid free in LS IOD error path
...
Bluetooth: hci_event: fix LE list UAF on reset
...
crypto: sun8i-ss - Remove crypto_rng interface
...
crypto: qce - fix CCM AAD buffer underallocation
...
xfrm: espintcp: fix UAF during close
...
nfc: st21nfca: validate ATR_REQ length against the received frame
...
erofs: cap LZMA stream pool size
...
crypto: virtio - bound the akcipher result length
...
Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing
...
HID: sensor: custom: Fix use-after-free in enable_sensor
...
node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding
...
infinte loop in libpcap before 1.10.7
...
OOBR and OOBW in libpcap before 1.10.7
...
OOBR in libpcap before 1.10.7
...
division by zero in libpcap before 1.10.7
...
rpcapd memory leak in libpcap before 1.10.7
...
abort() in libpcap before 1.10.7 on an invalid BPF opcode
...
OOBR in rpcap client in libpcap before 1.10.7
...
xmldom: Quadratic-memory consumption
...
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
...
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
...
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
...
xmldom: DocType `name` Injection Bypasses requireWellFormed
...
xmldom: Element name injection via createElement() bypasses requireWellFormed
...