CVE Vulnerability Catalog

In DBI for Perl before version 1.652, a heap out-of-bounds write occurs via an unvalidated numeric placeholder that sets the binder counter in preparse. A crafted statement can cause a write beyond the allocated buffer.

In DBI for Perl before version 1.652, a heap out-of-bounds write occurs on 32-bit Perl due to integer wraparound in the output buffer size computed by preparse. A very long statement can cause a write beyond the allocated buffer.

The TrueBooker plugin for WordPress up to version 1.2.6 is vulnerable to account takeover. The add_front_user_update() AJAX handler is registered for unauthenticated users and accepts an arbitrary truebooker_wp_user_id value, which is passed directly to wp_update_user() without verifying authentication or ownership. This allows unauthenticated attackers to change any user's email address, including an administrator's, and then use the native password reset flow to take over the account.

The User Profile Builder plugin for WordPress up to version 3.16.4 is vulnerable to authentication bypass via type confusion. The wppb_log_in_user() function calls absint() on the return value of wp_insert_user() before performing an is_wp_error() check. When a registration is submitted with a 61–70 character username, WordPress rejects it with a WP_Error object, but absint() coerces that object to the integer 1, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This allows unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover.

In the Linux kernel's iommu/vt-d subsystem, the Present bit is not cleared before tearing down a scalable-mode context entry, creating a window where hardware can fetch a torn entry, leading to unpredictable behavior or spurious faults. The issue affects device_pasid_table_teardown(), which was not aligned with a previous fix.

In the Linux kernel's rxrpc subsystem, lack of synchronization between rxrpc_kernel_charge_accept and socket teardown can lead to use-after-free. A concurrent rxrpc_discard_prealloc can free the rxrpc_backlog structure while a preallocation worker still uses it.

In the Linux kernel's rxrpc subsystem, when reading an OOB message with MSG_PEEK, the message is moved to the pending_oobq queue even though it should not be removed from the queue. This leads to double-free and use-after-free, potentially causing memory corruption.

In the Linux kernel's rxrpc subsystem, rxgk_issue_challenge() frees the page containing the challenge content after invoking the tracepoint, but the whdr pointer passed to the tracepoint points into the just-freed page, leading to use-after-free.

In the Linux kernel, the rxrpc subsystem fixed a double unlock in rxrpc_recvmsg() when handling OOB messages.

In the Linux kernel, the AFS subsystem fixed a netns teardown issue to cancel the preallocation charger. afs_charge_preallocation() skips charging when net->live is false, and afs_rx_new_call() avoids requeuing the charger.

In the Linux kernel, vxlan_gro_prepare_receive() has a potential null pointer dereference when sk_user_data is set to NULL during execution. This could lead to a system crash.

In the Linux kernel, the DLM module has an issue with the ordering of message handles in the send_queue, which can lead to refcounting issues and use-after-free. An attacker could exploit this to crash the system.

In the Linux kernel, addrconf_dad_failure() in IPv6 could overwrite DEAD state with ERRDAD, leading to use-after-free and system crash. The fix checks the state before transitioning to ERRDAD and performs operations in a single critical section.

In the Linux kernel, in the RDMA/srpt driver, the immediate data length check did not check for integer overflow, allowing a malicious initiator to bypass bounds check and pass ~4GB length to sg_init_one(). The fix uses check_add_overflow().

A vulnerability was found in the Linux kernel's nvme-multipath driver. The nvme_ns_head structure has a flexible array current_path[] indexed by NUMA node ID. Memory allocation used num_possible_nodes, which on systems with sparse NUMA IDs (e.g., POWER9) leads to out-of-bounds access (slab-out-of-bounds).

In the Linux kernel, the md/raid10 driver has been fixed to reset read_slot when reusing r10bio for discard. If the r10bio was previously used for a read, read_slot could be non-negative, causing the cleanup to skip bio_put() on repl_bio.

In the Linux kernel, a vulnerability in the NVMe driver has been fixed regarding an incorrect bounds check for the fdpcidx index in the FDP (Flexible Data Placement) mechanism. The bug used > instead of >=, incorrectly accepting an index equal to NUMFDPC + 1.

In the Linux kernel, a vulnerability in the OCFS2 filesystem was found due to missing validation of fast symlinks during inode read. A corrupted inode with a zero-cluster symlink can cause an out-of-bounds read beyond the inode block buffer, leading to a use-after-free error.

In the Linux kernel, a vulnerability in the RDMA/siw driver was fixed that caused a use-after-free when disassociating a socket from an endpoint. The issue occurred during processing of a malformed MPA request, potentially leading to closure of the new endpoint and access to freed memory.

In the Linux kernel, the lockd service's nlm4svc_lookup_file() function uses uninitialized bytes in file_hash() when the file handle length is less than LOCKD_FH_HASH_SIZE. This causes the same handle to hash to different buckets, leading to lookup failures. The fix zeroes only the tail bytes that file_hash() would otherwise consume.