CVE Vulnerability Catalog

In the Linux kernel, a vulnerability in the accel/ivpu driver is fixed by preventing re-exporting of imported GEM objects. Re-exporting causes loss of buffer flags settings, leading to incorrect device access and data corruption.

In the Linux kernel's fbdev udlfb driver, vm_ops are added to dlfb_ops_mmap to prevent use-after-free. Lack of vm_ops allowed stale memory mappings after buffer replacement, leading to access to freed pages.

In the Linux kernel, in the WWAN t7xx driver, the t7xx_port_enum_msg_handler() function uses the modem-supplied port_count field as a loop bound without checking that the message buffer contains sufficient data. Sending port_count=65535 in a 12-byte buffer triggers a slab-out-of-bounds read of up to 262140 bytes. Appropriate size checks have been added.

In the Linux kernel, in the RDS stack, when iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), pages are released but rm->data.op_nents is not reset. Later, rds_message_purge() iterates over the incorrect non-zero op_nents and frees them again, leading to a double free.

When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build a list of network names and use bsddialog(1) to prompt the user to select a network. The shell script implementation did not prevent shell expansion. As a result, a suitably crafted network name can be used to execute commands via a subshell. The problem can be exploited to execute code as root on the system running bsdinstall or bsdconfig. The attacker needs to create an access point with a specially crafted name and be within range of a Wi-Fi scan. bsdinstall and bsdconfig are vulnerable as soon as the user prompts them to scan, without needing to select the malicious network.

The ptrace(PT_SC_REMOTE) function fails to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls, allowing a user with debugging capabilities to trigger arbitrary code execution in the kernel, even if the target process has no special privileges. This missing validation enables an unprivileged local user to escalate privileges and potentially gain full control of the system.

In the FreeBSD kernel, a file descriptor can be closed while a thread is blocked in poll(2) or select(2). The kernel fails to unlink blocked threads before freeing the object, leading to a use-after-free vulnerability. An unprivileged local user can exploit this to gain superuser privileges.

Insufficient validation of Autoprimary SOA queries has been detected, which may lead to incorrect DNS service behavior.

The libcasper(3) library does not verify that the socket descriptor fits within the FD_SETSIZE (1024) limit for select(2). An attacker can cause large file descriptors to be allocated, leading to stack corruption.

A heap-based buffer overflow vulnerability in the LXF element parser of MediaArea MediaInfoLib, which could be exploited by an attacker to execute arbitrary code remotely or cause application crashes.

Gmission Web Fax versions 3.0 before 3.1 contain an unrestricted upload of dangerous file types and improper input validation vulnerability, allowing remote code execution.

Mattermost versions 11.6.x through 11.6.0, 11.5.x through 11.5.3, 11.4.x through 11.4.4, and 10.11.x through 10.11.14 fail to properly validate integration URLs for path traversal. This allows a malicious authenticated user to call arbitrary APIs using the system admin's Mattermost auth token via path traversal in the integration action URL.

A vulnerability in the setcred(2) system call in the Linux kernel. Before checking the caller's privileges, the user-supplied supplementary groups list is copied into a fixed-size kernel stack buffer without length validation. This can lead to a stack buffer overflow, exploitable by an unprivileged local user.

Vulnerability in Netatalk 2.1.0 through 4.4.2: incomplete sanitization of extended attribute (EA) path components allows remote authenticated attacker to write files outside intended metadata namespace via crafted EA names.

In Netatalk versions 3.1.0 through 4.4.2, multiple heap out-of-bounds reads exist in the Spotlight RPC deserialization code. A remote authenticated attacker can obtain sensitive information or cause minor service disruption.

An out-of-bounds read in ASP session ID handling in Netatalk 1.3 through 4.4.2 allows an adjacent network attacker to obtain limited information or cause a denial of service via a crafted ASP request.

A missing output length bounds check in pull_charset_flags() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service via crafted character set data.

An integer underflow vulnerability in the dsi_writeinit() function of Netatalk versions 1.5.0 through 4.4.2 allows a remote unauthenticated attacker to cause a denial of service via a crafted DSI write request.

An authentication bypass vulnerability in Netatalk versions 2.2.2 through 4.4.2 allows a remote privileged user to authenticate as an arbitrary user via the admin auth user mechanism.

A logic error involving bitwise OR operations in Netatalk 3.1.4 through 4.4.2 allows a remote authenticated attacker to inject OS commands and execute arbitrary code.