CVE Vulnerability Catalog

A vulnerability in Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The multiprocessing library with the forkserver start method permits pickle deserialization from any user on the same local network of the machine.

The email module in Python through 3.11.3 incorrectly parses email addresses containing special characters. The wrong portion of an RFC2822 header is identified as the value of the addr-spec.

The CIL compiler in SELinux 3.2 has a use-after-free vulnerability in the __cil_verify_classperms function, called from __cil_verify_classpermission and __cil_pre_verify_helper.

Serving WebSocket protocol upgrades over an HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.

SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.

A vulnerability in SQLite up to version 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.

A TOCTOU race condition in pg_dump in PostgreSQL allows an object creator to replace another relation type with a view or foreign table, executing arbitrary SQL functions as the user running pg_dump, often a superuser. The attack requires waiting for the right moment.

A critical vulnerability was found in SQLite3 up to version 3.43.0 in the sessionReadRecord function of ext/session/sqlite3session.c. Manipulation leads to a heap-based buffer overflow, potentially allowing remote code execution.

Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise see.

A buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to cause temporary denial of service on platforms where a 1-byte over-read leads to process termination. This affects the database server and libpq.

The urllib.parse.urlsplit() and urlparse() functions in Python improperly validate bracketed hosts (`[]`), accepting hosts that are not IPv6 or IPvFuture. This violates RFC 3986 and could enable SSRF attacks if a URL is processed by multiple URL parsers.

A medium severity vulnerability in CPython where regular expressions allow excessive backtracking during tarfile.TarFile header parsing, leading to ReDoS via specially crafted tar archives.

Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g., PATH). This often suffices for arbitrary code execution, even without a database server OS user account.

A high severity vulnerability in the CPython zipfile module affecting zipfile.Path. When iterating over entry names in a zip archive (e.g., namelist(), iterdir()), unexpected behavior may occur. The more common zipfile.ZipFile class is unaffected.

In the Linux kernel, a vulnerability related to use-after-free bugs has been fixed, which occurs during the detachment of the FarSync T-series card. These issues may arise in the fst_remove_one() function, where fst_card_info is deallocated, but fst_tx_task or fst_int_task may still be active.

A vulnerability has been identified in the Linux kernel related to the logic in GHES/CPER, which does not detect if the section length is too large. This may lead to improper processing of CPER records for ARM processors.

A vulnerability has been identified in the Linux kernel related to a reference count leak in the of_get_display_timings() function. This issue occurs during the processing of device nodes, potentially leading to improper memory management.

A vulnerability has been identified in the Linux kernel related to the gfs2_fiemap() function, which can lead to recursive inode lock taking. The issue occurs when the fiemap buffer is memory mapped to the same inode.

A vulnerability in the Linux kernel has been fixed that caused sporadic user-space crashes and heap corruption on Alpha systems during memory compaction.

A vulnerability has been identified in the Linux kernel that has been resolved. In the error path, the function cx88_alsa_dma_unmap() has been added to release resources acquired by cx88_alsa_dma_map().