CVE Vulnerability Catalog

A memory-related vulnerability has been discovered in an upstream library used for Image Optimization in Next.js, which can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. The issue affects sharp versions older than 0.35.5.

Per-request raw: true was ignored by some read methods, which still ran the configured serializer's load (Marshal by default) on values flagged as serialized — including get_multi, get_multi_cas, get_multi_with_metadata, get_cas and get_with_metadata.

In the Linux kernel, in the Btrfs filesystem, an issue with readahead on the relocation inode was fixed when the filesystem uses a RAID stripe tree (RST), which could cause ENOENT errors.

A design flaw in image processing software that modifies JPEG images might not modify the original EXIF thumbnail, potentially leaking sensitive visual information that was removed from the main JPEG image.

p_token and l_token were checked only for CR, LF and NUL. A token containing spaces added arbitrary meta flags to the command — e.g. changing an item's TTL on a read, creating stub items on a miss, turning a delete into a stale tombstone, or choosing incr's initial value.

In the Linux kernel, in the Bluetooth subsystem (MGMT), possible deadlocks were fixed that could occur due to hci_cmd_sync_dequeue, causing threads to block for extended periods.

In the Linux kernel, in the DRM/XE driver (guc_submit), a race condition around the suspend_pending field was fixed, which could cause assertions and warnings in certain test scenarios.

In the Linux kernel, in the Bluetooth subsystem (hci_conn), the function disable_delayed_work_sync is used instead of cancel_delayed_work_sync, which not only cancels ongoing work but also disables new submissions, which is desirable.

In the Linux kernel's btrfs filesystem, a use-after-free of the block device file occurs in __btrfs_free_extra_devids(). The issue may arise when mounting two btrfs images with the same fsid.

Catdoc v0.95 contains a NULL pointer dereference in the xls2csv component at src/xlsparse.c. This can lead to an application crash.

In the Linux kernel's F2FS filesystem, there is potential corruption when moving a directory, similar to an issue in ext4. The fix addresses this problem.

In libdoc through 2019-01-28, doc2text in catdoc.c has a NULL pointer dereference. This can lead to an application crash.

In the Linux kernel's bcachefs filesystem, a missing bounds check in superblock validation could allow out-of-bounds read. The fix adds the missing check.

In the Linux kernel's networking subsystem, a dangling sk pointer is left when socket creation fails, potentially leading to use-after-free when __sock_release() is called with an fentry probe.

In the Linux kernel, a race condition was fixed in the OA TC6 network driver between reference pointers for TX packets. The issue involves managing two skb pointers for packets enqueued from the network stack.

In libdoc through 2019-01-28, calcFileBlockOffset in ole.c allows division by zero. This can lead to an application crash.

In the Linux kernel, a double accounting race was fixed in Btrfs when btrfs_run_delalloc_range() fails. The issue occurs when block size is smaller than page size and can lead to kernel crash.

The getlong function in numutils.c in libdoc through 2017-10-23 has a heap-based buffer over-read that allows attackers to cause a denial of service (application crash) via a crafted file.

In the Linux kernel, the Android Binder driver no longer stores a pointer to a VMA for later use outside the mmap_lock. This was unsafe because the pointer could reference freed memory.

In the Linux kernel, a vulnerability was found in the tracing mechanism where trace_event_file lacks reference counters. This can lead to use-after-free and kernel crash.