24590 matches found
Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction
...
If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
...
Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails
...
Missing type checks leading to hash rewind and passing on crafted data
...
GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks.
...
f2fs: fix to avoid potential panic during recovery
...
drm/amd/display: Fix incorrect size calculation for loop
...
When a network error occurred during page load, the prior content could have remained in view with a blank URL bar. This could have been used to obfuscate a spoofed web site. This vulnerability affects Firefox < 126.
...
jfs: add check read-only before txBeginAnon() call
...
Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.
...
The Linux kernel before 2.6.32.4 allows local users to gain privileges or cause a denial of service (panic) by calling the (1) mmap or (2) mremap function, aka the "do_mremap() mess" or "mremap/mmap mess."
...
Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
...
An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_file function.
...
Cross-site Scripting (XSS)
...
drm/amdgpu: Fix variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()'
...
strace allows local users to read arbitrary files via memory mapped file names.
...
Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox < 125, Firefox ESR < 115.12, and Thunderbird < 115.12.
...
Request smuggling in aiohttp
...
HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX
...
smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect()
...
mm, slub: avoid zeroing kmalloc redzone
...
Das U-Boot from v2020.10 to v2022.07-rc3 was discovered to contain an out-of-bounds write via the function sqfs_readdir().
...
f2fs: avoid infinite loop to flush node pages
...
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.
...
Memory safety bugs present in Firefox 126. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 127.
...
An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.
...
drm/amd/display: Fix handling of plane refcount
...
bpf: Defer work in bpf_timer_cancel_and_free
...
drm/xe/xe_devcoredump: Check NULL before assignments
...
wifi: ath12k: Fix memory leak due to multiple rx_stats allocation
...
HDF5 H5FSsection.c H5FS__sect_find_node heap-based overflow
...
Unsafe deserialization in knplabs/knp-snappy
...
arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
...
Path traversal via Clean on Windows in path/filepath
...
Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
...
drm/msm/dpu: Add mutex lock in control vblank irq
...
smb: client: fix potential UAF in smb2_is_valid_lease_break()
...
Kernel: ksmbd: smb2_open out-of-bounds read information disclosure vulnerability
...
An iterator stop condition was missing when handling WASM code in the built-in profiler, potentially leading to invalid memory access and undefined behavior. *Note:* This issue only affects the application when the profiler is running. This vulnerability affects Firefox < 126.
...
of: module: add buffer overflow check in of_modalias()
...
x86/mm, kexec, ima: Use memblock_free_late() from ima_free_kexec_buffer()
...
fbdev: hyperv_fb: Allow graceful removal of framebuffer
...
In violation of spec, cookie prefixes such as `__Secure` were being ignored if they were not correctly capitalized - by spec they should be checked with a case-insensitive comparison. This could have resulted in the browser not correctly honoring the behaviors specified by the prefix. This vulnerability affects Firefox < 127.
...
Libssh: write beyond bounds in binary to base64 conversion functions
...
An issue was discovered in Arm Mbed TLS before 2.24.0. An attacker can recover a private key (for RSA or static Diffie-Hellman) via a side-channel attack against generation of base blinding/unblinding values.
...
GNU objdump 2.43 is vulnerable to Buffer Overflow in the BFD (Binary File Descriptor) library's handling of tekhex format files.
...
Memory safety bugs present in Firefox 118. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 119.
...
accel/ivpu: Fix locking order in ivpu_job_submit
...