CVE Vulnerability Catalog

In the Linux kernel's bcachefs filesystem, a missing bounds check in superblock validation could allow out-of-bounds read. The fix adds the missing check.

A memory-related vulnerability has been discovered in an upstream library used for Image Optimization in Next.js, which can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. The issue affects sharp versions older than 0.35.5.

In the Linux kernel, an overflow in the ring-buffer's __rb_map_vma function was fixed, which occurred when calculating the number of pages (nr_pages). A check was added before the calculation to avoid the issue.

A vulnerability in applications using the App router with the Cache Component can lead to remote code execution. The application must have a `use cache` function that returns multiple typed arrays.

In the Linux kernel's drm/amdgpu/mes driver, a use-after-free issue exists. The fix removes the fence fallback timer to eliminate random errors.

In the Linux kernel's F2FS filesystem, there is potential corruption when moving a directory, similar to an issue in ext4. The fix addresses this problem.

In the Linux kernel's btrfs filesystem, a use-after-free of the block device file occurs in __btrfs_free_extra_devids(). The issue may arise when mounting two btrfs images with the same fsid.

In the Linux kernel, in the Bluetooth subsystem (hci_conn), the function disable_delayed_work_sync is used instead of cancel_delayed_work_sync, which not only cancels ongoing work but also disables new submissions, which is desirable.

In the Linux kernel, in the Btrfs filesystem, an issue with readahead on the relocation inode was fixed when the filesystem uses a RAID stripe tree (RST), which could cause ENOENT errors.

In the Linux kernel, in the Bluetooth subsystem (MGMT), possible deadlocks were fixed that could occur due to hci_cmd_sync_dequeue, causing threads to block for extended periods.

In the Linux kernel, in the DRM/XE driver (guc_submit), a race condition around the suspend_pending field was fixed, which could cause assertions and warnings in certain test scenarios.

Słaby algorytm szyfrowania w Easy-RSA w wersjach od 3.0.5 do 3.1.7 umożliwia lokalnemu atakującemu łatwiejsze złamanie prywatnego klucza CA, gdy został on utworzony przy użyciu OpenSSL 3.

Sudo VISudo version 1.6.8 and earlier allows local users to corrupt arbitrary files via a symlink attack on temporary files.

A vulnerability in the XML::Parser library for Perl (up to version 2.45) causes a heap buffer overflow, leading to double free or corruption and crashes. The issue occurs in the parse_stream() function in Expat.xs when the :utf8 PerlIO layer is used, because Perl returns decoded characters while SvPV() expects raw bytes.

The development server contains a path traversal vulnerability on Windows when serving files from `servedir`. Due to the use of `path.Clean()` (which only normalizes forward-slash `/` separators) instead of a Windows-aware path normalization function, it is possible to craft malicious requests.

A vulnerability in the virtio-gpu module of the Linux kernel involves an incorrect overflow check when allocating 2D images. This flaw can lead to a buffer overflow, potentially enabling privilege escalation or system crash.

`NestedSecretsSettingsSource` reads secret values from files in a configured `secrets_dir`. When `secrets_nested_subdir=True`, a directory entry inside `secrets_dir` that is a symbolic link pointing outside `secrets_dir` is followed, allowing access to files outside the configured directory.

A vulnerability in the Linux kernel related to unsound scalar forking in maybe_fork_scalars() for BPF_OR has been fixed. The issue occurred when the source operand was a constant and the dst range was signed in the range [-1, 0].

A vulnerability in the Linux kernel related to the cpumask_of_node() function has been resolved. This function could not properly handle the NUMA_NO_NODE index, potentially leading to system errors.

A vulnerability in the Linux kernel has been resolved that allowed special inodes to be treated as regular files. The change introduced in commit af153bb63a33 requires any inode to be one of the specified types.