CVE Vulnerability Catalog

A use-after-free vulnerability exists in the XML parser functionality of GCC Productions Inc. Fade In 4.2.0. A specially crafted .xml file can lead to heap-based memory corruption.

W wersji Firefox 142 istniała możliwość, że skompromitowany proces podrzędny mógł wywołać błąd use-after-free w procesie GPU lub przeglądarki za pomocą wywołań IPC związanych z WebGPU. Ta podatność mogła umożliwić ucieczkę z piaskownicy procesu podrzędnego.

A flaw in Red Hat Openshift AI Service's TrustyAI component grants all service accounts and users cluster-wide permissions to get, list, and watch any pod in any namespace. It also allows access to all persistentvolumeclaims and lmevaljobs.

The “Diagnostics Tools” page of the TropOS 4th Gen web configuration utility does not properly validate user-controlled input, allowing an authenticated high-privileged user to inject commands into the device command shell. Injected commands can be used to execute SUID applications and gain root access.

On TropOS 4th Gen devices, an authenticated user able to run user-level shell commands can gain access via SSH to an unrestricted root shell. This is possible through abuse of a set of scripts and executables that allow certain commands to be run as root from an unprivileged context.

A command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated user with low privileged network access for the configuration utility can execute arbitrary commands on the underlying OS to obtain root SSH access to the TropOS 4th Gen device.

An unauthenticated user can connect to a publicly accessible database using arbitrary credentials. The system grants full access to the database by leveraging a previously authenticated connection through a "mmBackup" application. This flaw allows attackers to bypass authentication mechanisms and gain unauthorized access to database with sensitive data. This issue affects Asseco mMedica in versions before 11.9.5.

A slab-out-of-bounds read vulnerability was discovered in the Linux kernel's hfsplus_uni2asc() function in the HFS+ filesystem. The issue occurs when the function is called from hfsplus_listxattr() for extended attributes, where the data structure has a different size than the standard one, causing a read beyond the allocated buffer.

W jądrze Linuxa rozwiązano podatność związaną z funkcją PERF_IDX2OFF(), która mogła prowadzić do przepełnienia przy obsłudze dużych rozmiarów buforów AUX (>= 2 GiB). Zmienna nr_pages została rzutowana na unsigned long, aby uniknąć tego problemu.

A vulnerability was found in the Linux kernel's NBD (Network Block Device) driver, allowing the use of unsupported socket types. The fix restricts accepted sockets to TCP and UNIX stream only.

A vulnerability in the Linux kernel's BPF implementation for RISC-V architecture causes improper sign extension of struct ops return values, leading to a kernel panic during the ns_bpf_qdisc selftest due to invalid memory access.

In the Linux kernel, a vulnerability was found in the BPF mechanism where explicit access checks to implicit padding in the bpf_sock_addr structure were missing. Syzkaller triggered a kernel warning when reading from offset 60, causing a context access conversion error.

In the Linux kernel, the tcp_metrics module replaced three dst_dev() calls with the lockdep-enabled helper dst_dev_net_rcu(). This is a security fix related to proper lock usage.

In the IPv4 stack of the Linux kernel, functions icmpv4_xrlim_allow() and ip_defrag() were changed to prevent a potential use-after-free vulnerability. Also, dst_dev_rcu() with lockdep support was added to several other functions.

In the Linux kernel, a vulnerability was found in the PPS (Pulse Per Second) mechanism where pps_register_cdev() fails to set the release hook before device registration. On registration failure, put_device() may trigger a warning and potential double-free.

In the Linux kernel, in the DRM MSM driver, there is an object reference leak in the VM_BIND error path. If a handle lookup fails, previously obtained object references are not dropped.

In the NTFS3 subsystem of the Linux kernel, an integer overflow was found in the run_unpack function. A malformed runlist in an MFT record can lead to arbitrary disk data access or destruction, bypassing access controls.

In the Linux kernel, the NTFS3 driver lacks validation of the $BITMAP bitmap during index allocation. If the bitmap is empty while index blocks exist, on-disk corruption may occur.

A use-after-free vulnerability was discovered in the Linux kernel's SMC module in the __pnet_find_base_ndev() function. The issue occurs during connection setup when a network device is accessed after being freed, potentially causing system crashes.

In the Linux kernel crypto compression subsystem, there is a mismatch in the order of alloc_ctx and free_ctx operations in scomp_alg and crypto_acomp_streams structures. Structure layout randomization can cause the function pointer order to be inconsistent, leading to errors.