CVE Vulnerability Catalog

In the Linux kernel, a vulnerability exists in the ipvlan module where raw packets from a PF_PACKET socket sent over an IPv6-backed ipvlan device in L3 mode trigger a WARN_ON_ONCE() in sk_mc_loop(). The issue arises from using skb->sk (the packet socket) in the ipvlan_process_v{4,6}_outbound path, leading to incorrect behavior with multicast packets. This has been fixed by calling ip{6}_local_out() with NULL instead of skb->sk.

A spoofing vulnerability in Microsoft Edge (Chromium-based) allows an attacker to falsify content or user interface elements. This flaw can be exploited to display a fake website, impersonating a trusted source.

A spoofing vulnerability in Microsoft Edge (Chromium-based) allows attackers to falsify content or user interface elements. This flaw can be exploited to display deceptive information, potentially leading to fraud or data theft.

A Cross Site Scripting (XSS) vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity.

In the Linux kernel, the usb-storage alauda driver did not verify whether the media was properly initialized. If alauda_init_media() fails, the uzonesize member remains 0, potentially causing divide errors in alauda_read_data() and alauda_write_lba().

In the Linux kernel, the MSM driver (for Qualcomm SoCs) has a null pointer dereference in msm_ioctl_gem_submit, potentially leading to a kernel panic.

In the Linux kernel, the cpufreq subsystem called the optional exit() callback without checking for a valid pointer and did not clear the freq_table pointer when the callback was absent. The fix adds proper checks.

In the Linux kernel, the net/mlx5e driver (Mellanox) has a netif state handling flaw. When netdev registration fails, mlx5e_suspend does not free resources because netif_device_present() returns false, leading to memory leaks and a NULL pointer Oops.

In the Linux kernel, a bug in md_bitmap_get_counter fails to set returned blocks, causing a softlockup during RAID resync when the bitmap size is less than the array size. The issue manifests as a hang in the mdX_resync thread.

A data race condition has been identified in the Linux kernel's af_unix subsystem. The unix_release_sock() function atomically writes to sk->sk_shutdown using WRITE_ONCE, while unix_stream_sendmsg() reads it non-atomically, causing a data race detected by KCSAN.

In the Linux kernel, the stmmac Ethernet driver has a bug where reinitializing the EST structure also resets the embedded mutex, triggering a DEBUG_LOCKS_WARN_ON warning and a failure in __mutex_lock. The fix moves the lock to struct stmmac_priv and reacquires the mutex during initialization.

A possible deadlock exists in the Linux kernel's netrom subsystem within the nr_rt_ioctl() function. The issue arises from incorrect lock ordering between nr_node_list_lock and nr_node->node_lock. A local attacker could exploit this to cause a system hang.

In the Linux kernel, the bcm crypto module (spu2_dump_omd function) increased the pointer value by ciph_key_len instead of hash_iv_len, which could lead to going beyond buffer boundaries. The bug was fixed by changing ciph_key_len to hash_iv_len.

In the Linux kernel, the carl9170 wifi driver lacked comprehensive validation of USB endpoint types, causing warnings during URB submission. The fix adds a thorough check of all endpoints, accounting for differences between high-speed and full-speed configurations.

A flaw was found in the Linux kernel's ar5523 wifi driver where USB endpoint types were not properly verified. Syzkaller reported a warning about an endpoint being used with an unexpected type, leading to usb_submit_urb being called with an incorrect pipe. The fix adds checks for the existence and correct types of all required endpoints.

In the Linux kernel, the qedf scsi driver copied a buffer from userspace without ensuring NUL termination, which could lead to an out-of-bounds read when using kstrtouint. The issue was fixed by replacing memdup_user with memdup_user_nul.

In the Linux kernel, the net/mlx5 driver has a deadlock when disabling/enabling LAG. If loading a slave's IB representor fails, the eswitch error flow unloads all representors, including Ethernet ones, causing the LAG lock to be acquired again and triggering a deadlock. The fix reloads only IB representors upon LAG change.

In the Linux kernel, the media atomisp ssh_css driver has a NULL pointer dereference in load_video_binaries() when allocation of mycs->yuv_scaler_binary fails, and the function is later called with that pointer in unload_video_binaries().

A vulnerability in urllib3 causes the Proxy-Authorization header not to be stripped on cross-origin redirects when not using urllib3's built-in proxy support. This could leak credentials to a malicious server under specific conditions. The severity is low and requires misconfiguration.

In certain scenarios a malicious website could attempt to display a fake location URL bar which could mislead users as to the actual website address. This vulnerability affects Firefox for iOS before version 127.