CVE Vulnerability Catalog

W jądrze Linuxa zidentyfikowano podatność, która została rozwiązana. Dotyczy ona modułu wifi: mac80211, gdzie funkcja ieee80211_ocb_rx_no_sta() zakłada istnienie ważnego kontekstu kanału, co ma miejsce tylko po dołączeniu do OCB.

W jądrze Linuxa rozwiązano podatność dotyczącą kontrolera Rockchip DWC MSHC. Problem polegał na tym, że w trybach czasowych HS200 lub HS400, obniżenie częstotliwości zegara poniżej 52MHz prowadziło do zerwania połączenia.

A vulnerability in the Linux kernel related to event handler initialization in IPMB has been resolved, which does not use I2C reads but requires a value to be set. Otherwise, an I2C read will return an uninitialized value from the bus driver.

A vulnerability related to locking usage for tcon fields in the Linux kernel has been resolved in the CIFS module. Previously, cifs_tcp_ses_lock was used to protect many objects, which has been improved by introducing dedicated locks for server, session, and tcon.

A vulnerability in the Linux kernel related to vhost has been resolved by moving the vdpa group bound check to vhost_vdpa. This reduces duplication and lowers the risk of a parent driver missing them.

A vulnerability in the libcurl library causes a memory leak when handling HTTP/2 server push. When an application allows server push and the number of headers exceeds the limit of 1000, libcurl aborts the push but fails to free previously allocated headers.

A vulnerability has been identified in the Linux kernel related to improper reference counting management in the 'xfrm_state' structure. The issue occurs during the NETDEV_UNREGISTER event, leading to reference count leaks.

A vulnerability has been identified in the Linux kernel related to the handling of fake USB devices that can send their own report descriptors. If the input_mapping() hook is not called, the pm->input_ep82 pointer remains NULL, leading to a system crash.

A flaw in glibc may cause the gaih_inet function to use freed memory in uncommon situations, leading to an application crash. This issue is only exploitable when getaddrinfo is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=.

A timing attack vulnerability on the ECDSA algorithm was discovered in the libgcrypt20 cryptographic library. An attacker can exploit timing differences in cryptographic operations to recover the private key.

The libpcre library in PCRE before version 8.44 is vulnerable to an integer overflow. The issue occurs when a large number is used after the (?C substring in a regular expression.

The email module in Python through 3.11.3 incorrectly parses email addresses containing special characters. The wrong portion of an RFC2822 header is identified as the value of the addr-spec.

A vulnerability has been identified in the Linux kernel within the ALSA usb-audio module, concerning the lack of size verification for URB packets during playback silencing. This issue may lead to uncontrolled writes outside the allocated buffer.

A vulnerability in SQLite up to version 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.

SQLite 3.30.1 mishandles parser-tree rewriting in the sqlite3WindowRewrite() function, affecting expr.c, vdbeaux.c, and window.c. The vulnerability is caused by incorrect error handling during window query rewriting.

Processing a maliciously formatted PKCS12 file may cause OpenSSL to crash, leading to a potential Denial of Service attack. Applications loading PKCS12 files from untrusted sources might terminate abruptly.

A flaw in shadow-utils fails to properly clear the buffer when a new password is entered twice and the second attempt fails. This leaves the first password in memory, potentially allowing an attacker with sufficient access to retrieve it.

A vulnerability in systemd causes systemd-coredump to ignore the kernel's fs.suid_dumpable setting, potentially leading to a local information leak.

Vulnerability in the PDO PostgreSQL driver for PHP causes an invalid character sequence (e.g., \x99) in a prepared statement parameter to lead to quoting errors when PDO::ATTR_EMULATE_PREPARES is enabled. Affects PHP versions 8.1.x before 8.1.34, 8.2.x before 8.2.30, 8.3.x before 8.3.29, 8.4.x before 8.4.16, and 8.5.x before 8.5.1.

A vulnerability in the Linux kernel has been resolved by moving the wait_on_sem() function out of the spinlock. The issue occurred with iommu.strict=1, potentially leading to system lockups under high load conditions.