CVE Vulnerability Catalog

In the Linux kernel for powerpc/pseries, plpar_hcall() and related functions did not enforce proper result buffer sizes, potentially leading to stack corruption. The fix changes declarations to explicitly-sized arrays, enabling compiler detection of such errors.

In the Linux kernel, the mtk-vcodec driver has a potential NULL pointer dereference in SCP. The return value of devm_kzalloc() needs to be checked to avoid this issue. Similar to CVE-2022-3113.

In the Linux kernel f2fs filesystem, during remount the SB_INLINECRYPT flag is cleared and re-set, causing a window where new files may not use inlinecrypt, potentially leading to data corruption if wrappedkey_v0 is enabled. The fix removes the clearing of this flag in default_options.

In the Linux kernel, the dw-axi-dmac driver has a vulnerability that overruns the hw_desc array when the number of descriptors exceeds allocated memory, potentially causing a kernel panic. The fix adds a new field to track allocated descriptors and removes an unnecessary call.

In the gve driver of the Linux kernel, a bug was found where napi->skb is left referencing a freed skb after dev_kfree_skb_any(). This can lead to a dangling pointer on subsequent napi_get_frags calls.

In the Linux kernel, the blk-flush subsystem has a bug in the use of the request.queuelist, which can lead to a kernel crash. The fix changes the list usage to list_add_tail and adds list initialization in the flush callback.

In the i915 graphics driver in the Linux kernel, an issue was found where the DPT object can be shrunk in some scenarios while the actual framebuffer is not, leaving it on the DPT's bound_list. This leads to an attempt to rewrite PTEs via a stale CPU mapping, causing a panic.

In the Linux kernel, the vmxnet3 driver has a vulnerability where after a failed memory allocation for the RX data ring, the desc_size field is not reset, causing the hypervisor to reference invalid memory during packet reception. This leads to a kernel panic (BUG) in skb_panic.

In the Linux kernel, the br_mst_set_state function of the network bridge has suspicious RCU usage that may lead to warnings and potential errors. The fix changes the VLAN group dereference to the appropriate RCU helper.

In the Linux kernel's BPF subsystem, there is a potential use-after-free in bpf_link_free() where the link can be freed by dealloc_deferred but the code still uses dealloc afterward.

In the Linux kernel SCSI driver mpt3sas, there is a potential out-of-bounds access when using test_bit() and set_bit() on a single word. The fix increases the allocation to at least sizeof(unsigned long) to provide sufficient space.

In the Linux kernel, the cachefiles module has a use-after-free vulnerability because requests are not removed from the xarray during flushing. This can lead to use of freed memory. The fix removes requests from the xarray when flushing.

In the Linux kernel's hns3 network driver, a concurrent scenario can cause a kernel crash when link status changes and the roce driver is uninitialized.

A vulnerability has been identified in the Linux kernel related to a race condition between namespace cleanup and garbage collection in the list:set type in ipset. These issues may lead to use after free.

In the Linux kernel, the btrfs filesystem has a use-after-free vulnerability caused by a race during device replace. While loading zone info, a device is extracted from the chunk map without proper synchronization, which can lead to use of freed memory after the replace operation completes.

In the Linux kernel, a use-after-free vulnerability was found in the IMA module related to the dname.name field of a dentry. The name can change on rename and the earlier value can be freed, leading to unsafe dereference.

System uwierzytelniania Securepoint UTM niewłaściwie obsługuje klucze OTP, co umożliwia ominięcie weryfikacji drugiego czynnika w interfejsie administracyjnym oraz portalu użytkownika. Dotknięte wersje to UTM 11.5 do 12.6.4 oraz Reseller Preview 12.7.0. Problem został naprawiony w wersjach UTM 12.6.5 i 12.7.1.

Wtyczka MStore API – Create Native Android & iOS Apps On The Cloud dla WordPressa jest podatna na obejście uwierzytelniania we wszystkich wersjach do i włącznie 4.14.7. Problem wynika z niewystarczającej weryfikacji parametru 'phone' w funkcjach 'firebase_sms_login' i 'firebase_sms_login_v2'.

Wtyczka Wallet for WooCommerce dla WordPressa jest podatna na atak typu SQL Injection poprzez parametr 'search[value]' we wszystkich wersjach do i włącznie z 1.5.4. Problem wynika z niewystarczającego zabezpieczenia dostarczonego przez użytkownika oraz braku odpowiedniego przygotowania istniejącego zapytania SQL.

Wykryto problem w oprogramowaniu układowym BMC Supermicro na wybranych płytach głównych X11, X12, H12, B12, X13, H13 i B13 (oraz modułach CMM6). Nieautoryzowany użytkownik może przesłać spreparowane dane do interfejsu, co prowadzi do przepełnienia bufora stosu i może skutkować zdalnym wykonaniem dowolnego kodu na BMC.