CVE Vulnerability Catalog

Sudo VISudo version 1.6.8 and earlier allows local users to corrupt arbitrary files via a symlink attack on temporary files.

When addressparser finds no address by its strict reading, it falls back to pulling one out of the free text with /\s*\b[^@\s]+@[^\s]+\b\s*/. That pattern backtracks quadratically, causing high resource consumption when processing a single header.

The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability, leading to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation.

A vulnerability exists in the nodemailer package (npm) affecting versions from 2.7.2 to 10.0.1. Details are not fully described in the provided snippet, but vulnerable versions are confirmed.

A vulnerability in the Linux kernel related to parameter validation for packet data in communication with nci NFC chips has been resolved. The introduced fix has caused issues with communication with these chips.

A vulnerability in the Linux kernel related to V3D rendering has been resolved, which occasionally caused segment size mismatch warnings when CONFIG_DMA_API_DEBUG was enabled.

A vulnerability has been identified in the Linux kernel related to ntb_hw_switchtec, which may lead to undefined behavior when the number of MW LUTs is set to zero.

A vulnerability in the Linux kernel has been resolved in the HID: logitech-hidpp module, which could lead to system crashes when a report has no fields.

In the Linux kernel, a fake timeout has been removed to avoid request leaks. This change requires drivers to be responsible for calling blk_should_fake_timeout() at appropriate code paths.

A vulnerability has been identified in the Linux kernel related to use-after-free in tasklets during device removal. The issue occurs when the PCA-200E or SBA-200E adapter is being detached, potentially leading to unexpected system behavior.

A vulnerability in the Linux kernel has been fixed that could lead to a divide-by-zero error in the tcf_skbedit_hash() function. This issue was addressed by adding support for SKBEDIT_F_TXQ_SKBHASH.

A vulnerability has been identified in the Linux kernel regarding missing syscalls in the audit read class. The missing 'at' variants of getxattr() and listxattr() may allow bypassing audit rules when reading file extended attributes.

A vulnerability related to a memory leak in the error path in the radio-keene module has been fixed in the Linux kernel. The issue occurred in the usb_keene_probe() function, where a failure in device registration could lead to a memory leak.

A vulnerability has been identified in the Linux kernel related to the fchmodat2() function, which is not included in the audit attribute class. This function, introduced in version 6.6, allows changing file attributes similarly to chmod().

A vulnerability has been identified in the Linux kernel related to the asynchronous creation of sub-groups in the PCI context. This could lead to a NULL pointer dereference if the driver directory is removed before the work completes.

A vulnerability has been identified in the Linux kernel that leads to a memory leak when the cfg80211_inform_bss_frame() function fails. If this function returns NULL, the allocated buffer 'buf' is not freed, resulting in a memory leak.

A vulnerability has been identified in the Linux kernel related to improper memory deallocation in the uhdlc_memclean() function. The rx_buffer and tx_buffer are allocated as contiguous but freed as two separate buffers, which may lead to memory management issues.

A vulnerability has been identified and resolved in the Linux kernel. The issue concerns the pwlan variable, which may be NULL when passed to the rtw_free_network_nolock() function, leading to dereferencing of this variable.

In the GNU C Library (glibc) through version 2.29, there is uncontrolled recursion in the check_dst_limits_calc_pos_1 function in posix/regexec.c, which may lead to performance issues or application crashes.

A vulnerability has been identified in the Linux kernel related to calculating the maximum value M for scaler configuration. The issue was the lack of a check to ensure that the MIN_X_OUTPUT_SIZE register value is non-zero, which could lead to division by zero.