23144 matches found
Grub2: net: out-of-bounds write in grub_net_search_config_file()
...
When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.
...
media: streamzap: fix race between device disconnection and urb callback
...
atm: Fix NULL pointer dereference
...
Libsoup: denial of service in server when client requests a large amount of overlapping ranges with range header
...
udp: Fix memory accounting leak.
...
arm64: Don't call NULL in do_compat_alignment_fixup()
...
nfsd: put dl_stid if fail to queue dl_recall
...
ksmbd: fix use-after-free in ksmbd_sessions_deregister()
...
ksmbd: fix session use-after-free in multichannel connection
...
media: vimc: skip .s_stream() for stopped entities
...
ksmbd: use aead_request_free to match aead_request_alloc
...
net_sched: skbprio: Remove overly strict queue assertions
...
rtnetlink: Allocate vfinfo size for VF GUIDs when supported
...
netfilter: nf_tables: don't unregister hook when table is dormant
...
x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
...
ksmbd: add bounds check for create lease context
...
RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
...
fs/ntfs3: Fix a couple integer overflows on 32bit systems
...
ext4: fix off-by-one error in do_split
...
jq has signed integer overflow in jv.c:jvp_array_write
...
Bluetooth: btnxpuart: Fix kernel panic during FW release
...
fs/ntfs3: Prevent integer overflow in hdr_first_de()
...
net: mvpp2: Prevent parser TCAM memory corruption
...
net: fix geneve_opt length integer overflow
...
LoongArch: Increase ARCH_DMA_MINALIGN up to 16
...
x86/mce: use is_copy_from_user() to determine copy-from-user context
...
HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
...
RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
...
vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint
...
ocfs2: validate l_tree_depth to avoid out-of-bounds access
...
spufs: fix a leak on spufs_new_file() failure
...
spufs: fix a leak in spufs_create_context()
...
ASoC: imx-card: Add NULL check in imx_card_probe()
...
net: decrease cached dst counters in dst_release
...
nvme-rdma: unquiesce admin_q before destroy it
...
usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c
...
Libopensc: incorrect handling length of buffers or files in libopensc
...
btrfs: fix qgroup reserve leaks in cow_file_range
...
Expired Pointer Dereference in Wireshark
...
net: ibmveth: make veth_pool_store stop hanging
...
md: fix mddev uaf while iterating all_mddevs list
...
spufs: fix gang directory lifetimes
...
ksmbd: add bounds check for durable handle context
...
acpi: nfit: fix narrowing conversion in acpi_nfit_ctl
...
ksmbd: validate zero num_subauth before sub_auth is accessed
...
memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
...
An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect_bgp_open(tvbuff_t*tvb, proto_tree*tree, packet_info*pinfo), optlen components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected.
...