28400 matches found
smb/client: handle overlapping allocated ranges in fallocate
...
gopacket: Multiple layer decoders panic on crafted packets (out-of-bounds/underflow) enabling unauthenticated remote DoS via DecodingLayerParser
...
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
...
drm/i915/gem: Do not leak siblings[] on proto context error
...
go-git: Malicious reference names may modify files outside the reference storage
...
ila: reload IPv6 header after pskb_may_pull in checksum adjust
...
bpf: Fix UAF in sock clone early bailouts
...
tipc: serialize udp bearer replicast list updates
...
go-git: Worktree operations may follow symlinks
...
media: stm32: dcmi: unregister notifier on probe failure
...
wifi: nl80211: free RNR data on MBSSID mismatch
...
Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection
...
drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
...
Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
...
ksmbd: validate ACE size against SID sub-authorities
...
wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()
...
jsoup: Cleaner may expose markup with custom raw-text elements
...
ksmbd: bound DACL dedup walk to copied ACEs
...
GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching
...
drm/amdgpu: Fix context pstate override handling
...
staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
...
firmware: stratix10-svc: fix memory leaks and list corruption bugs
...
GitHub CLI: Partial token disclosure in `gh auth status` output
...
binfmt_misc: set have_execfd only once the interpreter is opened
...
GitHub CLI: Unescaped variable components in request URLs could allow path traversal
...
drm/amdkfd: Check bounds on CRIU restore queue type and mqd size
...
media: vivid: fix cleanup bugs in vivid_init()
...
gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
...
btrfs: reject free space cache with more entries than pages
...
mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
...
ipv4: fib: free fib_alias with kfree_rcu() on insert error path
...
Bluetooth: qca: fix NVM tag length underflow in TLV parser
...
wifi: mac80211: tear down new links on vif update error path
...
ipv6: ndisc: fix NULL deref in accept_untracked_na()
...
Rpm: heap buffer overflow in ndb slot table parsing
...
Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return
...
Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path
...
Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries
...
Client-Side Memory Leak in OCSP Response Checking
...
netfilter: nf_tables: clone set on flush only
...
libceph: fix two unsafe bare decodes in decode_lockers()
...
KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state
...
Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client
...
Apache Portable Runtime Utility: Heap buffer overflow in APR redis client
...
Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack
...
Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs
...
Kata Containers: Config Path Annotation Arbitrary File Loading
...
Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass
...