28472 matches found
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
...
xmldom: DocType `name` Injection Bypasses requireWellFormed
...
xmldom: Element name injection via createElement() bypasses requireWellFormed
...
ipv4: reject undersized MTUs in ip_do_fragment()
...
ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
...
tls: device: fix out-of-bounds write in tls_append_frag()
...
nvmet-tcp: bound SGL data length before allocating command buffers
...
usb: gadget: f_tcm: keep port count until LUN teardown completes
...
netfilter: nf_tables: don't queue packet path object notifications
...
usb: usbfs: fix use-after-free of usb_device in usbdev_release()
...
net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
...
net/tls: Fail tls_sw_splice_read() after a failed async decrypt
...
nfc: microread: validate target discovery payload lengths
...
RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
...
xfs: validate attr entry pointer before field access
...
HID: uclogic: fix use-after-free of inrange_timer on remove
...
nilfs2: reject invalid block index in GC ioctl
...
nfc: nci: add data_len bound checks to activation parameter extractors
...
nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
...
nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
...
nfc: pn533: purge fragmented skbs during cleanup
...
HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
...
ALSA: hda/tas2781: Cancel async firmware request at unbind
...
Bluetooth: hci_sync: Fix accept list UAF during suspend
...
nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
...
can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
...
fuse: fix invalidate lock leak on open O_TRUNC DAX failure
...
ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
...
ALSA: usb-audio: Complete cleanup after system-resume errors
...
tipc: avoid busy looping in tipc_exit_net()
...
selinux: require every boolean value to be defined
...
rndis_host: add overflow check in rndis_rx_fixup()
...
dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
...
xfs: don't livelock in scrub on a circular unlinked list
...
selinux: reject an unclaimed class value in security_get_classes()
...
drm/amdgpu: Reject UVD message with dimensions above 4096
...
drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered
...
PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).
...
fbdev: serialize mode sysfs access with lock_fb_info()
...
xfrm: drop ESP-in-TCP packets with no ingress device
...
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.
...
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
...
ipv6: fix use-after-free in ip6_finish_output2()
...
In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
...
ipv6: seg6: clear IPv4 control block on IPIP decapsulation
...
In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.
...
xfrm: fix xfrm_state_construct() auth-trunc leak
...
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
...