CVE Vulnerability Catalog

In the Linux kernel's slip driver, there is a use-after-free vulnerability in slip_receive_buf() when racing against a TTY hangup. slip_hangup() only calls slip_close(), causing concurrent access to freed memory.

In the Linux kernel's FEC driver, fec_ptp_stop() is called unconditionally on error and removal paths, but fec_ptp_init() is only called when bufdesc_ex is available. This can stop PTP that was never initialized.

A bug in the Linux kernel's usbatm (USB ATM) module was found where the ci_range fields vpi_bits and vci_bits were initialized to ATM_CI_MAX (-1). These values are used as bit shift counts in net/atm/common.c, causing undefined behavior (shift-out-of-bounds) and UBSAN warnings. The fix sets vpi_bits to 8 and vci_bits to 16.

In the Linux kernel's TCP implementation, there is corruption of urgent data on multi-segment retransmission. The retransmit path lacks a guard against multi-segment TSO, causing wrong urg_ptr copying and the receiver treats in-band data as urgent.

In the Linux kernel, htb_classify() in net/sched/sch_htb did not bound the number of hops between HTB inner classes selected by filters. A filter on an inner class can point back to itself or form a cycle, causing an infinite loop in the packet classification path with the qdisc lock held and BH disabled — a single packet triggers a soft lockup or kernel panic. The fix introduces a hop counter bounded by TC_HTB_MAXDEPTH and drops the packet with a rate-limited warning once the limit is exceeded.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority and contains no vulnerability description.

In the Linux kernel's TCP implementation, devmem TX without zero-copy is not enforced. When NETIF_F_SG is absent, the copy path may attempt invalid iovec access, causing errors or breaking invariants.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority and contains no vulnerability description.

Initializing the DNS stub resolver from /etc/resolv.conf or LOCALDOMAIN with a search list containing a domain of roughly 200 characters or more in GNU C Library versions 2.26 to 2.44 results in an assertion failure that aborts the process. The resolver truncates the search list when copying into the fixed-size _res.defdname buffer, but the consistency check compares against the wrong size and does not handle a first entry that does not fit, causing the assertion to fail.

The AsyncHttpClient (AHC) library versions 2.0.0 to 2.16.1 and 3.0.12 can leak origin credentials when using an HTTP proxy to reach an HTTPS origin. NettyRequestFactory and NettyRequestSender.sendRequestWithNewChannel attach Authorization to the plaintext CONNECT request before the TLS tunnel exists, exposing Basic or Digest credentials and per-connection NTLM, Kerberos, or SPNEGO tokens to the proxy and observers on the client-to-proxy hop.

The AsyncHttpClient (AHC) library in versions 3.0.8 through 3.0.12 does not enforce verification of SCRAM ServerSignature and Digest rspauth authentication results. On a non-TLS or compromised transport, an attacker can be accepted as the server without proving knowledge of the shared secret. The issue is fixed in version 3.0.12.

mport, the MidnightBSD Package Manager, prior to 2.7.8 handled directory assets (ASSET_DIR or ASSET_DIR_OWNER_MODE) in libmport/bundle_read_install_pkg.c using path-based mport_mkdirp(), ownership, and permission operations. A local attacker able to modify part of the target installation tree could use dot-dot traversal or substitute symlinks during privileged package installation, causing directory creation or attribute changes to affect attacker-selected paths outside the intended package directories.

mport, the MidnightBSD Package Manager, prior to 2.7.8 accepted non-HTTPS repository and package mirror URLs without a url_is_https() enforcement check in mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() in libmport/fetch.c. When a cleartext URL was configured or returned by mirror data, a network-positioned attacker could tamper with package index or package download traffic and compromise package selection or integrity.

mport, the MidnightBSD Package Manager, prior to 2.7.8 in create_sample_file() in libmport/bundle_read_install_pkg.c did not constrain absolute source and destination paths from the sample-file manifest directive to mport->root. A malicious or malformed package manifest could therefore direct privileged sample-file handling to copy or write outside the configured installation root, compromising local filesystem integrity.

MidnightBSD Package Manager (mport) prior to 2.7.8 did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could cause downloaded package data to be written outside the intended cache location or to an unsafe destination name.

mport, the MidnightBSD Package Manager, prior to 2.7.8 lacked a preflight check for incoming non-directory assets that already existed on disk. The affected logic across libmport/check_preconditions.c, libmport/install_primative.c, and libmport/mport_private.h did not apply MPORT_PRECHECK_FILE_CONFLICTS, so a crafted or conflicting package could overwrite a file owned by another package or unmanaged by mport. The check is bypassed only when the operator explicitly enables mport->force.

The mport_fetch_bootstrap_index() function in libmport/fetch.c prior to 2.7.8 could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or compromised mirror could therefore cause mport to proceed with an unverified or tampered bootstrap package index.

In mport prior to 2.7.8, mport_decompress_zstd() in libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal, and libmport/fetch.c did not consistently propagate those failures to index-fetch callers. A malicious or faulty mirror could supply compressed package index data that caused partial index output to remain available, resulting in package-index integrity loss or denial of service.

The MidnightBSD package manager mport in versions prior to 2.7.8 does not validate icmp_id and icmp_seq in ICMP replies and uses a fixed IP-header offset instead of ip_hl. A network attacker can influence mirror latency selection or trigger an out-of-bounds read via a malformed packet. The issue is fixed in version 2.7.8.

The MidnightBSD package manager mport in versions prior to 2.7.8 continues after MD5File() or SHA256_File() failure and compares an expected checksum with stale data in the hash buffer instead of a newly computed digest. An attacker able to influence an installed file or hashing failure conditions can obtain a misleading integrity result or hide a checksum failure. The issue is fixed in version 2.7.8.