24590 matches found
exfat: fix double free in delayed_free
...
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).
...
sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
...
Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information (an RSA private key) by measuring cache usage during an import.
...
libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.
...
drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'
...
HDF5 H5Fint.c H5F_addr_decode_len heap-based overflow
...
f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic
...
PCI: imx6: Fix suspend/resume support on i.MX6QDL
...
Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.
...
smb3: missing lock when picking channel
...
bnxt_en: Mask the bd_cnt field in the TX BD properly
...
nouveau: lock the client object tree.
...
Memory safety bugs present in Firefox 127 and Thunderbird 127. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 128 and Thunderbird < 128.
...
drm/amd/display: Handle dml allocation failure to avoid crash
...
The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.
...
ax25: fix use-after-free bugs caused by ax25_ds_del_timer
...
arm64: errata: Add Cortex-A520 speculative unprivileged load workaround
...
Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtime
...
vLLM using built-in hash() from Python 3.12 leads to predictable hash collisions in vLLM prefix cache
...
fbdev: efifb: Register sysfs groups through driver core
...
nvme-fabrics: use reserved tag for reg read/write command
...
Unintentional exposure of environment variables to subprocesses in sentry-sdk
...
vhost_task: Handle SIGKILL by flushing work and exiting
...
GNU Bison scan-code.c code_free double free
...
Khronos Group glslang Intermediate.cpp isConversionAllowed null pointer dereference
...
f2fs: don't set RO when shutting down f2fs
...
Undefined Behavior in bounded Crossbeam channel
...
wifi: ath12k: fix kernel crash during resume
...
A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
...
squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading process. Loading a specially crafted squashfs image may lead to a denial-of-service (DoS) condition or arbitrary code execution.
...
drm/amd/display: Increase array size of dummy_boolean
...
GNU Bison obprintf.c __obstack_vprintf_internal assertion
...
media: mtk-vcodec: potential null pointer deference in SCP
...
NFSD: fix race between nfsd registration and exports_proc
...
smb: client: fix potential UAF in cifs_stats_proc_write()
...
igc: avoid returning frame twice in XDP_REDIRECT
...
net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels
...
Memory safety bugs present in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.
...
rcu/nocb: Fix WARN_ON_ONCE() in the rcu_nocb_bypass_lock()
...
Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.
...
media: rkisp1: Fix IRQ disable race issue
...
ath11k: Fix frames flush failure caused by deadlock
...
An infinite recursion issue was discovered in eval.c in Netwide Assembler (NASM) through 2.14.02. There is a stack exhaustion problem resulting from infinite recursion in the functions expr, rexp, bexpr and cexpr in certain scenarios involving lots of '{' characters. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted asm file.
...
LoongArch: Update cpu_sibling_map when disabling nonboot CPUs
...
drm/amdgpu: Add basic validation for RAS header
...
ocfs2: Avoid touching renamed directory if parent does not change
...
drm/amd: check num of link levels when update pcie param
...
The png_set_text_2 function in pngset.c in libpng 1.0.x before 1.0.59, 1.2.x before 1.2.49, 1.4.x before 1.4.11, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted text chunk in a PNG image file, which triggers a memory allocation failure that is not properly handled, leading to a heap-based buffer overflow.
...