CVE Vulnerability Catalog

In the Linux kernel, a vulnerability in the DRM V3D driver occurs when an active performance monitor (perfmon) is destroyed without being stopped, leaving the `v3d->active_perfmon` pointer stale. This can lead to undefined behavior and system instability.

In the Linux kernel, a vulnerability in the mac80211 subsystem allows deactivating all links via the debugfs interface, triggering a WARN_ON that indicates an internal bug.

In the Linux kernel, a vulnerability in the UBIFS filesystem causes a null pointer dereference when dumping the TNC tree after clearing the slab cache. The pointer c->zroot.znode becomes NULL, leading to a system crash.

In the Linux kernel's remoteproc subsystem, a bug was found where ida_free is called for an ID that was not previously allocated by ida_alloc. The issue occurs in the rproc_alloc function when an error happens before ida_alloc is called, and then in the release path (rproc_type_release) an attempt is made to free an unallocated ID, triggering a kernel warning.

W systemie zarządzania rezerwacjami AtaksAPP występuje podatność na atak typu Cross-Site Scripting (XSS) z powodu niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych. Problem dotyczy wersji przed 4.2.3.

A flaw in the romfs module of GRUB2 allows integer overflow during buffer size calculation based on user-controlled filesystem geometry parameters. A crafted filesystem can cause a smaller-than-expected buffer allocation, leading to out-of-bounds writes in grub_romfs_read_symlink() and potentially arbitrary code execution.

A buffer overflow vulnerability was found in the jfs filesystem module of GRUB2. The grub_jfs_lookup_symlink() function writes beyond the allocated buffer when a specially crafted jfs filesystem is used. This can corrupt critical internal GRUB data and potentially lead to arbitrary code execution.

A flaw in GRUB2's reiserfs module allows integer overflow during symlink buffer size calculation, leading to heap out-of-bounds write and potential arbitrary code execution.

A stack overflow vulnerability was found in the BFS file system support in GRUB2. A crafted BFS filesystem image can trigger an uncontrolled loop, causing GRUB2 to crash.

A flaw was found in grub2 when reading tar files. The function allocating a buffer for the file name does not properly check for integer overflows, which can lead to a heap out-of-bounds write. This allows an attacker to bypass secure boot protections.

An integer overflow vulnerability was found in the BFS file system driver in GRUB2. When reading a file with an indirect extent map, GRUB2 fails to validate the number of extent entries, leading to a heap out-of-bounds read.

A flaw in the OpenSSH package causes each received ping packet to allocate a pong packet in memory, stored in a queue until key exchange completes. A malicious client can send such packets continuously, leading to uncontrolled memory consumption on the server.

A vulnerability in Minut M2 with firmware version #15142 allows extraction of cryptographic keys from internal flash. Physically proximate attackers can inject modified firmware into any other Minut M2 product via USB.

In the Linux kernel, a vulnerability was found where a potential deadlock can occur during sysfs ->store() calls. The issue arises when store callbacks (e.g., update_nr_requests, wbt, scheduler) allocate memory with GFP_KERNEL, which may trigger direct reclaim and deadlock while the queue is frozen. The fix marks the context with GFP_NOIO around sysfs ->store().

In the Linux kernel, a vulnerability was found where the ->enable callback is called unconditionally without checking if it is implemented. Some drivers (e.g., ptp_s390, ptp_vclock, ptp_mock) do not define this callback, leading to NULL pointer dereference.

A deadlock vulnerability (ABBA) was found in the Linux kernel's block layer when modifying queue limits via sysfs. The issue occurs when a user changes a limit (freezing the queue) while a device driver (e.g., SCSI sd) simultaneously revalidates limits, causing mutual blocking.

In the Linux kernel's HNS3 network driver, a vulnerability was found causing an Oops when unloading hclge and hns3 drivers in parallel. The issue occurs when hclge unload tries to disable SR-IOV for ae_dev nodes while hns3 unload removes those nodes, leading to memory corruption.

Wersje pakietu io.pebbletemplates:pebble od 0 do przed 4.1.0 są podatne na zewnętrzną kontrolę nazwy pliku lub ścieżki za pomocą tagu include. Atakujący z wysokimi uprawnieniami może uzyskać dostęp do wrażliwych lokalnych plików, tworząc złośliwe szablony powiadomień, które wykorzystują ten tag do dołączenia plików takich jak /etc/passwd lub /proc/1/environ.

A vulnerability in the Linux kernel causes a hang in nfsd4_shutdown_callback when an NFS client is in courtesy state, blocking for up to 15 minutes until TCP drops the connection.

In the Linux kernel, a vulnerability was found in the ip6_default_advmss() function, which lacked RCU protection when reading the network structure. This could lead to a use-after-free condition.