CVE Vulnerability Catalog

In the RabbitMQ amqp091-go client before version 1.13.0, readLongstr in read.go returns an empty string and nil instead of ErrSyntax when a declared longstr length exceeds 0x7FFFFFFF. The function leaves the declared field bytes unread while readTable continues parsing from the wrong offset. A malicious or compromised broker can supply an oversized longstr and desynchronize AMQP parsing.

In the RabbitMQ amqp091-go client before version 1.13.0, writeShortstr in write.go casts the byte length of AMQP shortstr property values to uint8 without rejecting values longer than 255 bytes. An application accepting oversized CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type values can serialize a wrapped length and truncated prefix without reporting an error.

In the RabbitMQ amqp091-go client before version 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can negotiate an obsolete protocol version when connecting through an amqps URI.

A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges. The vulnerability affects a login process accessible without authentication.

Nozomi Networks Labs identified a CWE-78 (OS Command Injection) vulnerability in the edgserver management service of Advantech EKI-1242EIMS firmware version V1.06.01. It allows a remote unauthenticated attacker to execute arbitrary OS commands as root via crafted requests to TCP port 5058.

The WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neutralizes special elements in the http_passwd_hidden and http_passwdConfirm_hidden parameters, allowing an authenticated attacker to execute arbitrary commands on the underlying operating system with root privileges. The issue is fixed in firmware version 1.1.0.651412.

The WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection in the /cgi-bin/portal.cgi endpoint, specifically through the cli_cookie POST parameter. The cli_cookie value is directly concatenated into a find command string without proper sanitization, allowing a remote, unauthenticated attacker to inject and execute arbitrary shell commands as root. The issue is fixed in firmware version 1.1.0.651412.

The WNC T-Mobile 5G Box IDU router is vulnerable to command injection in the ping functionality within the /cgi-bin/portal.cgi endpoint, specifically affecting the ping_ip, ping_size, and ping_times POST parameters. The root cause is the failure to verify and sanitize user-supplied input before incorporating it into a system command, allowing an authenticated attacker to execute arbitrary shell commands and gain root access. The issue is fixed in firmware version 1.1.0.651412.

In the Linux kernel, a vulnerability in skb_zerocopy() was fixed: it incorrectly called skb_tx_error() on the source skb when copying frags. This completed the zerocopy uarg and cleared the SKBFL_SHARED_FRAG flag on an skb still in use by the network stack. Specifically on the OVS_ACTION_ATTR_USERSPACE path, the skb was not freed on error, which could lead to ESP data being decrypted in place where the skb did not privately own frags, potentially causing data corruption or other issues.

In the Linux kernel, ni_create_attr_list() in the ntfs3 filesystem has a slab-out-of-bounds write. The function allocates a fixed buffer of record_size bytes and writes one ATTR_LIST_ENTRY per attribute without checking the buffer end. A crafted NTFS image with many minimum-size nameless attributes can overflow the heap buffer.

A vulnerability was found in the Linux kernel's Ceph filesystem where ceph_fname_to_usr() passed vmalloc() buffers to the fscrypt crypto API, which requires linear memory. This can cause kernel oopses, especially on non-x86 platforms. The fix adds support for vmalloc() buffers using a bounce buffer.

In the Linux kernel, nfsd4_revoke_export_states() drops nn->client_lock but the held stateid reference does not pin the client. A concurrent client teardown can free the client while revoke_one_stid() still dereferences it, causing a use-after-free.

In the Linux kernel, an nfs4_openowner left on nn->close_lru holds only a raw pointer to its nfs4_client. When the laundromat reaps entries, drops client_lock and calls nfs4_put_stid(), a concurrent force_expire_client() can free the client, causing a use-after-free.

In the Linux kernel, a bare lock owner left on nn->blocked_locks_lru holds only a raw pointer to its nfs4_client. When the laundromat reaps such a lock, the final nfs4_put_stateowner() takes the client's cl_lock, which a concurrent force_expire_client() may have already freed, causing a use-after-free.

In the Linux kernel, __spi_map_msg() mishandles DMA mapping ownership on partial map failure. When RX or TX mapping fails, flags and device pointers are not properly cleared, which can lead to re-unmapping or using a NULL/stale device pointer. This can trigger a kernel oops.

In the Linux kernel, the scsi target iscsi function iscsi_target_check_login_request() does not reserve a NUL terminator byte for the login buffer. With payload_length from 8189 to 8192, the entire 8192-byte buffer is filled and then consumed as a C string, leading to out-of-bounds reads. The vulnerability is reachable by an unauthenticated initiator when CHAP is configured.

In the Linux kernel, ceph_mds_check_access() traverses the s_cap_auths array without holding the mutex. A concurrent MDS session reopen can free this array while it is being inspected, resulting in a use-after-free.

In the Linux kernel, the nvme_alloc_ns() error path removes the namespace from the sibling list using list_del_rcu() but does not wait for SRCU readers before freeing the namespace struct. A concurrent reader in the multipath code may still hold a reference to ns when kfree(ns) runs, leading to a use-after-free.

In the Linux kernel, nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(), which does not wait for an already-started callback. As a result, during transport teardown the queue containing struct nvmet_sq can be freed or reused while nvmet_auth_expired_work() still accesses it.

In the Linux kernel, nvmet_tcp_try_recv_pdu() computes the remaining PDU payload length without bounding it against the size of the queue->pdu buffer. When a header digest is negotiated, a duplicate ICReq packet causes a 4-byte write past the end of the 128-byte buffer, overwriting queue->hdr_digest and queue->data_digest with attacker-controlled data.