24590 matches found
wifi: cfg80211: clear link ID from bitmap during link delete after clean up
...
drm/amdkfd: Fix lock dependency warning with srcu
...
mt76: mt7915: fix possible NULL pointer dereference in mt7915_mac_fill_rx_vector
...
An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a server crash or possibly information disclosure based on error responses. Affected configurations have MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled and MBEDTLS_SSL_IN_CONTENT_LEN less than a threshold that depends on the configuration: 258 bytes if using mbedtls_ssl_cookie_check, and possibly up to 571 bytes with a custom cookie check function.
...
media: av7110: fix a spectre vulnerability
...
mm/swap: fix race when skipping swapcache
...
ext4: filesystems without casefold feature cannot be mounted with siphash
...
octeontx2-pf: Fix resource leakage in VF driver unbind
...
btrfs: scrub: handle RST lookup error correctly
...
net: libwx: properly reset Rx ring descriptor
...
Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times. (For Mbed TLS, the fix is also available in versions 2.7.12 and 2.16.3.)
...
btrfs: don't drop extent_map for free space inode on write error
...
GNU elfutils eu-read readelf.c handle_dynamic_symtab null pointer dereference
...
Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
...
btrfs: fix block group refcount race in btrfs_create_pending_block_groups()
...
PM: hibernate: Avoid deadlock in hibernate_compressor_param_set()
...
mt76: mt7921: fix kernel crash at mt7921_pci_remove
...
RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers
...
phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode
...
Buffer overread when using an empty list with SSLContext.set_npn_protocols()
...
scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
...
net/sched: act_mirred: use the backlog for mirred ingress
...
mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath()
...
Command Injection
...
f2fs: fix to avoid panic once fallocation fails for pinfile
...
PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops
...
A use-after-free crash could have occurred on macOS if a Firefox update were being applied on a very busy system. This could have resulted in an exploitable crash. This vulnerability affects Firefox < 122.
...
Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH keys by measuring electromagnetic emanations.
...
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
...
RDMA/mlx5: Fix the recovery flow of the UMR QP
...
Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion
...
GNU Binutils ld libbfd.c bfd_malloc memory leak
...
A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0.
...
Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken
...
drm/amd/display: Fix out-of-bound accesses
...
md: Don't register sync_thread for reshape directly
...
In Netwide Assembler (NASM) 2.15rc0, a heap-based buffer over-read occurs (via a crafted .asm file) in set_text_free when called from expand_one_smacro in asm/preproc.c.
...
f2fs: fix null-ptr-deref in f2fs_submit_page_bio()
...
drm/amd/display: Initialize denominator defaults to 1
...
RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error
...
libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in some circumstances (e.g., hardware re-initialization upon a mid-video SPS change when Direct3D11 is used).
...
Linux Kernel BlueZ jlink.c jlink_init denial of service
...
spi: Fix null dereference on suspend
...
An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.
...
Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file
...
net/sched: flower: Fix chain template offload
...
ksmbd: fix use-after-free in ksmbd_session_rpc_open
...
Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3.
...