CVE Vulnerability Catalog

pypdf to darmowa i otwartoźródłowa biblioteka PDF napisana w czystym Pythonie. Przed wersją 6.12.0, atakujący mógł wykorzystać tę podatność do stworzenia pliku PDF, który prowadził do dużego zużycia pamięci, wymagając ekstrakcji tekstu w trybie układu z dużymi przesunięciami znaków.

bzip2 zawiera błąd off-by-one w narzędziu bzip2recover. Podczas przetwarzania specjalnie przygotowanego pliku, aplikacja wykonuje zapis poza granicami globalnego bufora, co prowadzi do uszkodzenia pamięci i awarii (denial of service).

A vulnerability exists in Apache Artemis that allows users with permissions to send or consume messages on an address to modify the routing-type of that address without having the createAddress permission. Users can send or consume messages with an unsupported routing-type, which should be rejected.

A vulnerability has been identified in the Linux kernel related to a runtime PM reference count leak in the i2c module for the ov5647 camera. The issue involves three control cases that do not call pm_runtime_put(), leading to reference count leaks.

A vulnerability related to the Xbox Remote controller has been resolved in the Linux kernel, concerning the violation of DMA coherency rules. The buffer for IO must not be part of the device structure, which could lead to data integrity issues.

In the Linux kernel, a vulnerability related to the lack of checks for return values from ioremap in the saa7164_dev_setup() function has been resolved. In case of failure, already allocated PCI memory regions are released and the device is removed from the global list.

A vulnerability has been identified in the Linux kernel within the batman-adv module, specifically in the batadv_bla_purge_claims() function. The issue arises when the function encounters a claim that is in the process of being released, leading to a NULL pointer dereference.

A vulnerability has been identified in the Linux kernel within the batman-adv module, which involves leaking a reference to the backbone_gw object when failing to add a new claim to the hash.

A vulnerability has been identified in the Linux kernel related to VRAM allocation in KFD. The absence of the AMDGPU_GEM_CREATE_VRAM_CLEARED flag allowed freshly allocated VRAM to contain stale data, leading to crashes in RCCL P2P transport.

A vulnerability in the Linux kernel related to the management of USB device resource lifetimes in SPI drivers has been fixed. Memory leaks could occur when drivers were unbound without physically disconnecting devices.

A vulnerability related to SPI controller deregistration has been fixed in the Linux kernel. The issue involved not properly releasing resources like DMA before deregistering the controller during driver unbind.

A vulnerability related to SPI controller deregistration has been fixed in the Linux kernel. The issue was that the controller was not properly deregistered before releasing resources like DMA during driver unbind.

A vulnerability related to memory leak in the xe_dma_buf_init_obj() function has been fixed in the Linux kernel in case of allocation failure. On error, the previously allocated memory is not freed, which can lead to memory leaks.

A vulnerability in the Linux kernel related to cgroup has been resolved, which could lead to system deadlock during the removal of a control group. The issue stemmed from improper management of tasks during their removal, potentially causing processes to be unable to terminate due to waiting for resource release.

A vulnerability has been identified in the Linux kernel due to missing checks for connected devices in pads, which may lead to a NULL pointer dereference when enabling the stream.

A vulnerability has been identified in the Linux kernel related to a memory leak of the device name. The device name allocated via kzalloc() in init_one_mc() is not freed on the normal removal path, leading to a memory leak.

A vulnerability in the Linux kernel has been resolved by replacing BUG_ON() calls in the sdma_v4_0_ring_emit_fence() function with WARN_ON() calls. This allowed unprivileged users to trigger a kernel panic through misaligned fence writeback addresses.

A vulnerability in the Linux kernel has been resolved by adding a NULL check for media_gt in the intel_hdcp_gsc_check_status() function. When media GT is disabled, the lack of allocation for media_gt leads to a kernel pagefault error.

A vulnerability has been identified in the Linux kernel related to the leak of the accepted connection count on transport mismatch. The issue occurs when the vsock_assign_transport() function fails or selects a different transport, leading to a permanent increment of sk_ack_backlog.

A vulnerability has been identified in the Linux kernel within the msm_ioctl_gem_info_get_metadata() function, which always returns 0, ignoring errors. This causes userspace to incorrectly interpret that the ioctl call succeeded when it did not.