CVE Vulnerability Catalog

In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, applications that based their authz filters upon Lyo-provided AbstractAdapterCredentialsFilter are vulnerable. An attacker can create a provisional trusted client (valid use-case) but then it can be used as a trusted client immediately without requiring the administrator approval to clear the provisional status. The 3-legged path requiring user interaction is not vulnerable and rejects provisional clients.

A flaw was found in FFmpeg in the tdsc_load_cursor() function, which writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to denial of service or arbitrary code execution.

A Cross-site Scripting vulnerability in the extract domain function in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via UI interaction, to read or write restricted files and conduct limited denial-of-service attacks in DSM.

A Server-Side Request Forgery (SSRF) vulnerability in the webhook function in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information.

Cross-site scripting vulnerability in Tangible Loops & Logic.

In the Linux kernel, a vulnerability in ptp: vmclock was fixed that allowed read-only mappings to become writable. The vmclock_miscdev_mmap() function rejected writable mappings of the shared vmclock ABI page with -EROFS, but left VM_MAYWRITE set. Userspace could map the page read-only and then upgrade it to writable with mprotect(), allowing the guest to corrupt host-written timekeeping data (sequence counter, UTC time, TSC offset) that the vmclock ABI defines as read-only. The fix clears VM_MAYWRITE on the read-only path so the mapping cannot be upgraded.

In the Linux kernel, a vulnerability in of: reserved_mem was fixed that caused an out-of-bounds write when too many dynamic regions are defined. On boot, fdt_scan_reserved_mem() saves each dynamically-placed /reserved-memory subnode into a local array of size MAX_RESERVED_REGIONS. If the device tree defines more than MAX_RESERVED_REGIONS dynamically-placed regions, the function writes past the end of the local array. The fix adds a bounds check that logs an error and skips the excess regions, restoring the original behavior.

In the Linux kernel, a vulnerability in wifi: mac80211 was fixed regarding validation of individual TWT parameters before driver setup. ieee80211_process_rx_twt_action() only partially validates a received S1G TWT setup frame before queueing it. An individual agreement can therefore reach ieee80211_s1g_rx_twt_setup() with twt->length too short for the full struct ieee80211_twt_params. The individual path passes twt to drv_add_twt_setup(). Both the tracepoint and the driver callback consume the complete parameters block, not merely req_type. The fix does not pass a short individual agreement to the driver. Broadcast agreements remain unchanged because they are rejected locally after accessing only req_type.

In the Linux kernel, a vulnerability in Bluetooth: ISO was fixed regarding dangling hcon references in iso_conn. After iso_conn_del(), ISO sockets should not dereference the hcon anymore. Currently, clearing iso_conn::hcon relies on iso_conn_del() releasing the last reference to the iso_conn. The fix simplifies this by explicitly clearing conn->hcon in iso_conn_del(), to avoid more complex reasoning on races about who holds the last reference.

In the Linux kernel, a vulnerability in iomap was fixed that caused a deadlock. iomap_split_ioend can split bios that already come from iomap_ioend_bioset and thus deadlock when the bioset is exhausted. The fix adds a separate bio_set to avoid this deadlock. Additionally, iomap_ioend_split_bioset is marked static as it is only used in ioend.c, fixing the sparse warning reported by the kernel test robot.

A vulnerability in the Linux kernel's MGLRU (Multi-Gen LRU) mechanism causes stale batch updates after memcg reparenting. A race between the page table walker and the memcg reparenting path can lead to underestimated nr_pages, potentially causing premature OOM.

In the Linux kernel, a vulnerability in mm/percpu-km was fixed that caused bitmap overflow and accounting issues in pcpu_create_chunk(). In pcpu_create_chunk(), nr_pages is the total contiguous backing allocation, i.e., nr_units * pcpu_unit_pages, but pcpu_chunk_populated() uses it to set chunk->populated, whose size is pcpu_unit_pages bitmap. Since bit N in chunk->populated means page offset N inside every unit is backed, when nr_units > 1, the function writes beyond chunk->populated. The fix uses chunk->nr_pages. It also fixes the global pcpu_nr_empty_pop_pages accounting, since pcpu_balance_free() only iterates up to chunk->nr_pages. The issue was introduced by commit a63d4ac4ab609, and later commit b539b87fed37f added pcpu_nr_empty_pop_pages and caused the accounting issue.

In the Linux kernel, the SCTP Adaptation Indication parameter length was not properly validated. A header-only parameter was accepted, leading to an out-of-bounds read and potential disclosure of four receive-buffer tail bytes.

In the Linux kernel's ALSA PCM subsystem, there is an issue with waking linked drain waiters on unlink. This can lead to use-after-free of a stack frame during a later wake-up.

In the Linux kernel's igc driver, there is an issue with napi_synchronize() in igc_down() that can cause the network interface to hang during shutdown when AF_XDP zero-copy is used.

In the Linux kernel's IPVS, there is an issue with propagating the one-packet flag to synced connections, which can lead to stale hash entries and use-after-free.

In the Linux kernel's io_uring, there is an issue with preserving per-task restrictions across exec. These restrictions are dropped during task context cleanup, allowing an unrestricted ring to be created after exec.

A vulnerability in the Linux kernel's SPI-NAND driver for Qualcomm chips (spi-qpic-snand) was found. The SET_FEATURE value was written to the register after command execution, causing a one-operation delay. As a result, the chip remained in OTP mode, making the flash memory unusable and the device unbootable.

In the Linux kernel's max17040 driver, there is an issue with handling a missing status supplier. When no supplier is registered, the function returns success but the status value remains uninitialized, potentially leading to reading invalid data by userspace.

In the Linux kernel's dasd driver, there is an issue with an undersized format-check buffer. The fmt_buffer_size variable is declared as int, causing truncation of the computed size and potentially leading to out-of-bounds write.