CVE Vulnerability Catalog

W jądrze systemu Linux napotkano podatność, która prowadzi do nieskończonej pętli w funkcji tcp_bpf_recvmsg_parser() w przypadku, gdy długość bufora w wywołaniu systemowym recvmsg wynosi 0. Problem ten został rozwiązany poprzez wprowadzenie odpowiednich poprawek.

Podatność CVE-2025-2488 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w Profelis Informatics SambaBox, co umożliwia ataki typu Cross-Site Scripting (XSS). Problem ten dotyczy wersji SambaBox przed 5.1.

W systemie automatyzacji bibliotek Yordam Informatics występuje podatność na atak typu XSS (Cross-site Scripting) z powodu niewłaściwego neutralizowania danych wejściowych podczas generowania stron internetowych. Problem dotyczy wersji przed 21.6.

In the Linux kernel, when cloning a device in btrfs, the associated zoned device info structure is not cloned for zoned filesystems. This leads to a NULL pointer dereference when accessing the device's zone info, e.g., when setting a zone as active.

W jądrze Linuxa naprawiono podatność związaną z wyciekiem połączeń, gdy konfiguracja tlink się nie powiodła. W przypadku niepowodzenia, nie zwalniano połączeń, co prowadziło do wycieku liczników referencji modułu oraz informacji o fscache.

A memory leak was discovered in the Linux kernel's netdevsim driver related to the fa_cookie field in the nsim_dev structure. The nsim_dev_trap_fa_cookie_write() function allocates memory for fa_cookie, but it is not freed when the driver is removed in nsim_drv_remove().

A bug in the Linux kernel's perf subsystem was fixed that could cause a hang while freeing a sigtrap event. The issue occurred when a related deferred signal was not sent before the file was closed, leading to task_work_cancel() failure and a hang on rcuwait_wait_event(). The fix acquires an event reference when queueing perf task work and releases it from the task work, with care taken for child and parent event release ordering.

In the Linux kernel, a vulnerability was resolved in perf/dwc_pcie: wrongly using struct device pci_dev as platform_data during platform_device_register caused a kmemdup copy of pci_dev, leading to list corruption as its mutex content remains the same as the original.

In the Linux kernel, the wifi ath12k driver has a memory leak when enabling extended statistics mode. The driver allocates a mon_mpdu object while handling the HAL_RX_MPDU_START TLV but does not free it when only extended statistics mode is active (without standalone monitor mode).

In the Linux kernel, a flaw in drm/xe/vf causes a virtual function (VF) to attempt a full GT reset despite lacking access to the GDRST register. Triggering a reset via debugfs or due to a hang condition leads to a kernel warning and stack trace. The fix sends an H2G VF_RESET action instead.

In the Linux kernel, the mediatek vcodec driver fixes a resource leak related to the scp device in firmware initialization. On MediaTek devices with an SCP, the mtk_scp structure must be explicitly removed to avoid a leak. The structure is freed if firmware structure allocation fails during initialization.

A null-ptr-deref vulnerability was found in the Linux kernel's LOCKDEP mechanism. It occurs when a CIFS (or similar) module is unloaded while a TCP socket still exists in FIN-WAIT-1 state, causing an attempt to access a lock class from the already removed module.

A flaw was found in Keycloak where the org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to bypass requirements such as setting up two-factor authentication.

Memory safety bugs present in Firefox 137 and Thunderbird 137. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

Vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on sites that invoked the Storage Access API, enabling potential CSRF attacks across origins. Fixed in Firefox 138 and Thunderbird 138.

A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-bounds read access and potentially, memory corruption. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Thunderbird 138, and Thunderbird 128.10.

A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. This bug only affects Thunderbird for Android. Other versions of Thunderbird are unaffected. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution. This bug only affects Firefox for Windows. Fixed in Firefox ESR 128.10, Firefox ESR 115.23, and Thunderbird 128.10.