23143 matches found
Grub2: net: out-of-bounds write in grub_net_search_config_file()
...
GNU elfutils eu-readelf libdw_alloc.c __libdw_thread_tail memory corruption
...
jfs: add sanity check for agwidth in dbMount
...
net: vlan: don't propagate flags on open
...
PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type
...
media: venus: hfi_parser: refactor hfi packet parsing logic
...
ext4: fix off-by-one error in do_split
...
mptcp: fix NULL pointer in can_accept_new_subflow
...
jq has signed integer overflow in jv.c:jvp_array_write
...
backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()
...
x86/mce: use is_copy_from_user() to determine copy-from-user context
...
HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
...
LoongArch: BPF: Fix off-by-one error in build_prologue()
...
Glibc: glib prior to 2.82.5 is vulnerable to integer overflow and buffer under-read when parsing a very long invalid iso 8601 timestamp with g_date_time_new_from_iso8601().
...
vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint
...
Bluetooth: btnxpuart: Fix kernel panic during FW release
...
RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
...
fs/ntfs3: Prevent integer overflow in hdr_first_de()
...
ocfs2: validate l_tree_depth to avoid out-of-bounds access
...
spufs: fix a leak on spufs_new_file() failure
...
spufs: fix a leak in spufs_create_context()
...
ASoC: imx-card: Add NULL check in imx_card_probe()
...
net: mvpp2: Prevent parser TCAM memory corruption
...
net: decrease cached dst counters in dst_release
...
net: fix geneve_opt length integer overflow
...
LoongArch: Increase ARCH_DMA_MINALIGN up to 16
...
net: ibmveth: make veth_pool_store stop hanging
...
ksmbd: add bounds check for create lease context
...
x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
...
ksmbd: fix session use-after-free in multichannel connection
...
ksmbd: fix use-after-free in ksmbd_sessions_deregister()
...
media: vimc: skip .s_stream() for stopped entities
...
atm: Fix NULL pointer dereference
...
net_sched: skbprio: Remove overly strict queue assertions
...
Libsoup: denial of service in server when client requests a large amount of overlapping ranges with range header
...
RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
...
ksmbd: use aead_request_free to match aead_request_alloc
...
md: fix mddev uaf while iterating all_mddevs list
...
Glibc: stack read overflow in getaddrinfo in no-aaaa mode
...
media: streamzap: fix race between device disconnection and urb callback
...
In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service. Impact: * This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.
...
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.
...
drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1
...
Redis allows out of bounds writes in hyperloglog commands leading to RCE
...
Bypass extraction filter to modify file metadata outside extraction directory
...
bnxt_en: Fix out-of-bound memcpy() during ethtool -w
...
irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs
...
wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release
...