CVE Vulnerability Catalog

A flaw in the romfs module of GRUB2 allows integer overflow during buffer size calculation based on user-controlled filesystem geometry parameters. A crafted filesystem can cause a smaller-than-expected buffer allocation, leading to out-of-bounds writes in grub_romfs_read_symlink() and potentially arbitrary code execution.

A buffer overflow vulnerability was found in the jfs filesystem module of GRUB2. The grub_jfs_lookup_symlink() function writes beyond the allocated buffer when a specially crafted jfs filesystem is used. This can corrupt critical internal GRUB data and potentially lead to arbitrary code execution.

A flaw in GRUB2's reiserfs module allows integer overflow during symlink buffer size calculation, leading to heap out-of-bounds write and potential arbitrary code execution.

A stack overflow vulnerability was found in the BFS file system support in GRUB2. A crafted BFS filesystem image can trigger an uncontrolled loop, causing GRUB2 to crash.

A flaw was found in grub2 when reading tar files. The function allocating a buffer for the file name does not properly check for integer overflows, which can lead to a heap out-of-bounds write. This allows an attacker to bypass secure boot protections.

An integer overflow vulnerability was found in the BFS file system driver in GRUB2. When reading a file with an indirect extent map, GRUB2 fails to validate the number of extent entries, leading to a heap out-of-bounds read.

Cross-Site Request Forgery (CSRF) vulnerability in kareemsultan Social Links allows Cross Site Request Forgery. This issue affects Social Links from n/a through 1.0.11.

A flaw in the OpenSSH package causes each received ping packet to allocate a pong packet in memory, stored in a queue until key exchange completes. A malicious client can send such packets continuously, leading to uncontrolled memory consumption on the server.

A vulnerability in Minut M2 with firmware version #15142 allows extraction of cryptographic keys from internal flash. Physically proximate attackers can inject modified firmware into any other Minut M2 product via USB.

In the Linux kernel, the change "drm/amd/display: Use HW lock mgr for PSR1" was reverted because it may cause a system hang when two eDP panels are connected.

In the Linux kernel, a vulnerability was found where a potential deadlock can occur during sysfs ->store() calls. The issue arises when store callbacks (e.g., update_nr_requests, wbt, scheduler) allocate memory with GFP_KERNEL, which may trigger direct reclaim and deadlock while the queue is frozen. The fix marks the context with GFP_NOIO around sysfs ->store().

In the Linux kernel, a vulnerability was found where the ->enable callback is called unconditionally without checking if it is implemented. Some drivers (e.g., ptp_s390, ptp_vclock, ptp_mock) do not define this callback, leading to NULL pointer dereference.

A deadlock vulnerability (ABBA) was found in the Linux kernel's block layer when modifying queue limits via sysfs. The issue occurs when a user changes a limit (freezing the queue) while a device driver (e.g., SCSI sd) simultaneously revalidates limits, causing mutual blocking.

A flaw was found in the Linux kernel's networking code that occurs when net.core.dev_weight is set to 0. This causes process_backlog() to potentially return 0 and clear the NAPI_STATE_SCHED bit, leading to repeated NAPI polling and eventually a double list add warning in lib/list_debug.c. The issue is resolved by ensuring the NAPI weight is always non-zero.

In the Linux kernel's HNS3 network driver, a vulnerability was found causing an Oops when unloading hclge and hns3 drivers in parallel. The issue occurs when hclge unload tries to disable SR-IOV for ae_dev nodes while hns3 unload removes those nodes, leading to memory corruption.

Stack-based Buffer Overflow in libmodbus v3.1.10 allows overflow of the buffer allocated for Modbus response if the function tries to reply to a request with unexpected length.

Wersje pakietu io.pebbletemplates:pebble od 0 do przed 4.1.0 są podatne na zewnętrzną kontrolę nazwy pliku lub ścieżki za pomocą tagu include. Atakujący z wysokimi uprawnieniami może uzyskać dostęp do wrażliwych lokalnych plików, tworząc złośliwe szablony powiadomień, które wykorzystują ten tag do dołączenia plików takich jak /etc/passwd lub /proc/1/environ.

A flaw was found in the Linux kernel where vxlan_init() fails to check the return value of vxlan_vnigroup_init(). If initialization fails, a NULL pointer dereference occurs, leading to a kernel crash (general protection fault) during a later call to vxlan_uninit().

A vulnerability exists in the Linux kernel's team module due to insufficient validation of TEAM_OPTION_TYPE_STRING options. User-provided data lacking a NUL byte causes an uninitialized memory read (KMSAN: uninit-value) in string_nocheck. The issue was reported by syzbot and has been fixed.

In the Linux kernel, a vulnerability was resolved in KVM x86 regarding Hyper-V's SEND_IPI and SEND_IPI_EX hypercalls. If the local APIC is not emulated in-kernel, these hypercalls can lead to a NULL pointer dereference. The issue occurs when Hyper-V enlightenments are exposed to a guest without an in-kernel local APIC.