CVE Vulnerability Catalog

Podatność typu Server-Side Request Forgery (SSRF) w Salesforce Tableau Server na systemach Windows i Linux (moduły Amazon S3 Connector) umożliwia fałszowanie lokalizacji zasobów. Problem ten dotyczy Tableau Server w wersjach przed 2025.1.3, 2024.2.12 oraz 2023.3.19.

W EmbedThis GoAhead w wersji 2.5 występuje podatność na wstrzykiwanie HTML poprzez parametr name w goform/formTest. Atakujący może wykorzystać tę lukę do wprowadzenia złośliwego kodu HTML.

In the Linux kernel, uprobes can be used destructively when placed in the middle of an instruction. Since the kernel cannot verify if a byte is actually an instruction in the execution stream, the requirement for CAP_SYS_ADMIN for uprobes has been reinstated.

A use-after-free vulnerability was discovered in the Linux kernel's tipc_conn_close() function within the TIPC module. During network namespace dismantle, tipc_topsrv_stop() releases the IDR lock before calling tipc_conn_close(), allowing a concurrent worker thread to free the tipc_conn structure, resulting in a read-after-free.

A vulnerability in the Linux kernel's TCP stack involves incorrect signedness in the calculation of remaining space in an skb. A type promotion bug causes the 'copy' variable to become a large positive value, leading to overflow of 'sk_forward_alloc' and potential memory exhaustion.

A TOCTOU (time-of-check time-of-use) vulnerability was found in the vsock module of the Linux kernel during transport assignment. The transport assignment could race with module unloading, leading to use of a stale pointer.

In the Linux kernel's ATM CLIP subsystem, the function to_atmarpd() is called without RTNL lock, leading to potential NULL-pointer dereference. RTNL protection of atmarpd is insufficient because calls may come from unsleepable contexts.

In the Linux kernel's IPMI subsystem (msghandler), the function ipmi_create_user() uses a list iterator "intf" that may be an invalid pointer if the correct intf->intf_num is not found. Calling atomic_dec(&intf->nr_users) on an invalid pointer leads to memory corruption.

A vulnerability in the Linux kernel's KVM for SVM allows migration of SEV{-ES} state between hosts while vCPU creation is in progress. This can result in an SEV{-ES} VM having a non-SEV{-ES} vCPU, leading to a system crash when freeing VMSA memory.

In the Linux kernel's io_uring/msg_ring subsystem, a use-after-free vulnerability was found. The issue occurs when msg_ring adds a task to the local work queue that has already been freed, potentially leading to system crashes or exploitation.

In the Linux kernel, a vulnerability in the DRM/GEM subsystem allows a GEM handle to be released while the GEM buffer object is still attached to a DRM framebuffer. This causes the dma-buf to be freed, leading to a segmentation fault when the framebuffer is used in mode-setting operations.

In the Linux kernel's mm/rmap subsystem, the batched unmap logic in try_to_unmap_one() may read past the end of a PTE table when a large folio's PTE mappings are not fully contained within a single page table, leading to out-of-bounds access.

In the Linux kernel, an out-of-bounds access was found in the dispmix_csr_clk_dev_data function of the i.MX clock driver. When num_parents is 4, __clk_register() reads beyond the parent_names array, triggering a KASAN error.

In the Linux kernel's mlx5e driver, a race condition exists between disabling DIM (Dynamic Interrupt Moderation) and calling net_dim(). If NAPI checks the DIM state bit and sees it as active, then DIM gets disabled, the pointer to the DIM context may already be NULL, leading to a NULL pointer dereference and kernel panic.

W jądrze Linuxa zidentyfikowano podatność, która została naprawiona. Dotyczy ona potencjalnego błędu use-after-free w mechanizmie potwierdzania przerwania oplock/lease, który może wystąpić w przypadku błędu zwracanego przez ksmbd_iov_pin_rsp.

W systemie zarządzania biblioteką Koha w wersji 24.05 występuje podatność typu Cross-Site Scripting (XSS) w funkcji wyszukiwania OPAC. Niesanitizowane dane wprowadzone w polu wyszukiwania są odzwierciedlane w interfejsie historii wyszukiwania, co prowadzi do wykonania dowolnego kodu JavaScript w kontekście przeglądarki.

In the Linux kernel for RISC-V with the xtheadvector extension, vector context save/restore is incorrect – only registers v0-v7 are handled properly, while v8-v31 are corrupted.

In the Linux kernel, a change setting TASK_SIZE_MAX to LONG_MAX to optimize access_ok() has been reverted. Addresses between TASK_SIZE and LONG_MAX, though not valid user addresses, were accepted by get_user_pages_fast(), causing issues (e.g., in futex). The fix restores the default TASK_SIZE, at the cost of performance.

W jądrze Linuxa rozwiązano podatność związaną z interfejsem i2c w kontekście odczytu blokowego SMBUS. Problem polegał na braku weryfikacji długości wiadomości, co mogło prowadzić do nieprawidłowego odczytu, gdy długość wiadomości wynosiła '0' lub była większa niż maksymalna dozwolona liczba bajtów.

In the Linux kernel, a bug in the order of stopping perf sampling during do_exit() caused crashes when accessing userspace after its teardown. The fix reorders operations to stop perf before mm destruction and hardens PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER.