CVE Vulnerability Catalog

W jądrze Linuxa naprawiono podatność związaną z makrem GET_INSTANCE_ID, które powodowało panikę jądra podczas dostępu do atrybutów sysfs. Problem wynikał z błędu off-by-one w warunku pętli.

The vulnerability occurs when an application uses OAuth2::Client and the authorization server returns a redirect with a Location header in the form of a protocol-relative URI. In this case, OAuth2::Client#request may incorrectly resolve the redirect.

W określonych konfiguracjach proxy, atak typu denial of service na serwer Apache HTTP w wersjach od 2.4.26 do 2.4.63 może być wywołany przez nieufne klientów, co prowadzi do asercji w mod_proxy_http2. Dotyczy to konfiguracji, w której reverse proxy jest skonfigurowane dla zaplecza HTTP/2 z włączonym ProxyPreserve.

W jądrze Linuxa naprawiono podatność związaną z kolejnością wywołań funkcji przy usuwaniu urządzenia macb. Problem polegał na tym, że driver wywoływał phy_exit() przed unregister_netdev(), co prowadziło do ostrzeżenia z kernfs.

W niektórych procesorach AMD występuje podatność na wykonanie przejściowe, która może umożliwić atakującemu wnioskowanie danych w pamięci podręcznej L1D, co potencjalnie prowadzi do wycieku wrażliwych informacji przez granice uprawnień.

W Jansson w wersjach do 2.13.1 odkryto problem związany z błędem analizy w funkcji json_loads, który prowadzi do odczytu poza przydzielonym zakresem pamięci. Problem ten występuje tylko wtedy, gdy programista nie przestrzega specyfikacji API.

A vulnerability has been identified in the Linux kernel related to calculating the maximum value M for scaler configuration. The issue was the lack of a check to ensure that the MIN_X_OUTPUT_SIZE register value is non-zero, which could lead to division by zero.

A vulnerability in the Linux kernel related to possible null-pointer dereferences in the bcm_vk_read() function has been resolved. If the entry pointer is NULL and rc is set to -EMSGSIZE, an issue may occur.

A vulnerability has been identified in the Linux kernel that leads to a memory leak when the cfg80211_inform_bss_frame() function fails. If this function returns NULL, the allocated buffer 'buf' is not freed, resulting in a memory leak.

A vulnerability has been identified in the Linux kernel related to use-after-free in tasklets during device removal. The issue occurs when the PCA-200E or SBA-200E adapter is being detached, potentially leading to unexpected system behavior.

A vulnerability related to double dma_buf_unpin in failure path has been fixed in the Linux kernel. In the function ib_umem_dmabuf_get_pinned_with_dma_device(), a failure may occur during the call to ib_umem_dmabuf_map_pages(), leading to improper memory management.

A vulnerability has been identified in the Linux kernel in the xfrm6_get_saddr() function, which does not check the return value of ipv6_dev_get_saddr(). If it fails, it may lead to the use of an uninitialized source address.

A vulnerability in the Linux kernel related to handling unsupported hardware configurations in the perf module for ARM CMN architecture has been resolved. Previously, unknown CMN models and their unknown revisions were accepted, which could lead to issues.

A vulnerability in the Linux kernel has been resolved in the HID: logitech-hidpp module, which could lead to system crashes when a report has no fields.

A vulnerability has been identified in the Linux kernel related to improper memory deallocation in the uhdlc_memclean() function. The rx_buffer and tx_buffer are allocated as contiguous but freed as two separate buffers, which may lead to memory management issues.

A vulnerability has been identified in the Linux kernel in the rtw_core_enable_beacon() function, which reads 4 bytes from an address that is not a multiple of 4. This can lead to system crashes on some devices.

A vulnerability in the Linux kernel has been resolved regarding the introduction of locking when enabling/disabling SR-IOV, which led to deadlocks.

A vulnerability has been identified in the Linux kernel related to ntb_hw_switchtec, which may lead to undefined behavior when the number of MW LUTs is set to zero.

A vulnerability in the Linux kernel has been fixed related to an error in the kcm_write_msgs() function when processing a message with a zero-fragment skb in the frag_list.

A vulnerability in the Linux kernel has been fixed that could lead to a divide-by-zero error in the tcf_skbedit_hash() function. This issue was addressed by adding support for SKBEDIT_F_TXQ_SKBHASH.