CVE Vulnerability Catalog

W jądrze Linuxa rozwiązano podatność związaną z brakiem sprawdzenia NULL w funkcji ufshcd_mcq_abort(). Może wystąpić wyścig między ścieżką zakończenia MCQ a obsługą przerwania, co prowadzi do problemów z zarządzaniem żądaniami.

W jądrze Linuxa naprawiono podatność związaną z ostrzeżeniami cancel_sync na niezainicjowanych strukturach work_struct. Ostrzeżenie zostało zgłoszone przez użytkownika Betty.

A vulnerability in the Mail library affects the q_value_decode and b_value_decode functions, which decode only the first RFC 2047 encoded-word in a string and use an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause incorrect decoding.

An issue was discovered in versions 6.0 before 6.0.5 and 5.2 before 5.2.14 regarding response headers that do not vary on cookies if a session is not modified, while `SESSION_SAVE_EVERY_REQUEST` is set to `True`. A remote attacker can steal a user's session after that user visits a cached public page.

A flaw was found in unzip due to improper handling of Unicode strings, leading to a null pointer dereference. An attacker can supply a specially crafted zip file, causing a crash or code execution.

The development server contains a path traversal vulnerability on Windows when serving files from `servedir`. Due to the use of `path.Clean()` (which only normalizes forward-slash `/` separators) instead of a Windows-aware path normalization function, it is possible to craft malicious requests.

Netplan leaks the private key of WireGuard to local users. Versions after 1.0 are not affected.

Logic error in PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8. Filtering functions like filter_var when validating URLs (FILTER_VALIDATE_URL) for certain URL types return invalid user information (username+password part of URLs).

In PHP versions 8.1.x before 8.1.31, 8.2.x before 8.2.26, 8.3.x before 8.3.14, when using streams with a configured proxy and the request_fulluri option, the URI is not properly sanitized, which can lead to HTTP request smuggling and allow the attacker to perform arbitrary HTTP requests through the proxy.

Serving WebSocket protocol upgrades over an HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.

Sudo VISudo version 1.6.8 and earlier allows local users to corrupt arbitrary files via a symlink attack on temporary files.

An integer overflow vulnerability exists in the Compound Document Binary File format parser of libgsf version v1.14.52. A specially crafted file can cause an integer overflow when processing the directory, leading to an out-of-bounds read.

A partial fix for CVE-2024-39884 in Apache HTTP Server 2.4.61 ignores some legacy content-type based configurations like AddType. Under certain circumstances with indirect file requests, this can lead to source code disclosure of local content.

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerable to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.

Windows libarchive has a remote code execution vulnerability. Technical details are not provided in the description.

Libarchive has a remote code execution vulnerability. Technical details are not provided in the description.

Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests.

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption.

HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.