CVE Vulnerability Catalog

In the Linux kernel, in the Bluetooth subsystem (MGMT), possible deadlocks were fixed that could occur due to hci_cmd_sync_dequeue, causing threads to block for extended periods.

In the Linux kernel, a vulnerability was found in the tracing mechanism where trace_event_file lacks reference counters. This can lead to use-after-free and kernel crash.

A TSIG packet with name compression can crash DNS. Incorrect size calculations when a TSIG record contains compressed names lead to a large out-of-bounds write, causing a server crash.

A vulnerability in applications using the App router with the Cache Component can lead to remote code execution. The application must have a `use cache` function that returns multiple typed arrays.

ImageMagick prior to versions 6.9.13-27 and 7.1.2-1 has undefined behavior (function-type-mismatch) in the splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds).

In the Linux kernel, in the Btrfs filesystem, an issue with readahead on the relocation inode was fixed when the filesystem uses a RAID stripe tree (RST), which could cause ENOENT errors.

The ReadPCXImage function in coders/pcx.c in ImageMagick 7.0.4.9 allows remote attackers to cause a denial of service (attempted large memory allocation and application crash) via a crafted file. This vulnerability exists because of an incomplete fix for CVE-2016-8862 and CVE-2016-8866.

A low-privilege authenticated Samba AD user can modify internal LDB special DNs via LDAP access, enabling a domain takeover.

A vulnerability has been identified in the Linux kernel related to ntb_hw_switchtec, which may lead to undefined behavior when the number of MW LUTs is set to zero.

A vulnerability has been identified and resolved in the Linux kernel. The issue concerns the pwlan variable, which may be NULL when passed to the rtw_free_network_nolock() function, leading to dereferencing of this variable.

A vulnerability has been identified in the Linux kernel related to the fchmodat2() function, which is not included in the audit attribute class. This function, introduced in version 6.6, allows changing file attributes similarly to chmod().

A vulnerability has been identified in the Linux kernel related to the asynchronous creation of sub-groups in the PCI context. This could lead to a NULL pointer dereference if the driver directory is removed before the work completes.

In systemd versions 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file in nspawn.

A vulnerability has been identified in the Linux kernel related to calculating the maximum value M for scaler configuration. The issue was the lack of a check to ensure that the MIN_X_OUTPUT_SIZE register value is non-zero, which could lead to division by zero.

A vulnerability in the Linux kernel related to V3D rendering has been resolved, which occasionally caused segment size mismatch warnings when CONFIG_DMA_API_DEBUG was enabled.

A vulnerability has been identified in the Linux kernel that leads to a memory leak when the cfg80211_inform_bss_frame() function fails. If this function returns NULL, the allocated buffer 'buf' is not freed, resulting in a memory leak.

A vulnerability in the Linux kernel related to parameter validation for packet data in communication with nci NFC chips has been resolved. The introduced fix has caused issues with communication with these chips.

In udev in systemd before version 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

A vulnerability in the Linux kernel related to the dma_free_coherent() function has been fixed, which was using an incorrect DMA handle in the error path. This could lead to improper unmapping of the buffer.

A vulnerability in telnet in GNU inetutils through version 2.7 allows servers to read arbitrary environment variables from clients via the NEW_ENVIRON SEND USERVAR command.