CVE Catalog

A use-after-free vulnerability has been identified in the Linux kernel's PowerPC pSeries VAS (Virtual Address Space) implementation. When a 'paste' address is mapped, the corresponding VMA (Virtual Memory Area) address is stored in the VAS window structure. This VMA is supposed to be updated during migration to unmap the paste address if the window is active. However, the VMA is not properly updated when the 'munmap' operation is performed, leading to invalid memory access during migration. This issue was highlighted by a KASAN (Kernel Address Sanitizer) report, which documented the slab-use-after-free error occurring in the 'reconfig_close_windows' function, triggered by the 'drmgr' task.

A use-after-free vulnerability has been identified in the Linux kernel's ublk device management. This issue arises when the 'add_disk()' function fails, potentially leading to a use-after-free condition. The vulnerability occurs because the 'ublk_abort_requests()' function, which is responsible for aborting all inflight requests, is called when exiting the uring context or handling timeouts. If 'add_disk()' fails, the 'gendisk' may have already been freed by the time 'ublk_abort_requests()' is called, creating the use-after-free scenario.

A vulnerability has been identified in the Linux kernel's tracing component, specifically related to the validation of count values for the 'tracing_cpumask_write' function. If an excessively large count is provided, it can trigger a warning during the bitmap parsing process. The vulnerability has been addressed by implementing a check to prevent invalid count values and ensuring that zero counts are properly handled.

A vulnerability in the Linux kernel's handling of the indirect branch tracker (IBT) can lead to a deadlock situation. This issue arises when an indirect branch instruction sets the CPU's IBT into a WAIT_FOR_ENDBRANCH (WFE) state, which is then improperly maintained across instruction boundaries. During the 'kernel IBT no ENDBR' self-test, where #CP faults are intentionally triggered, the WFE state must be cleared to prevent execution from getting stuck in a loop. While the Interrupt Descriptor Table (IDT) does not retain the WFE state, the FRED mechanism does, requiring software to manually clear it. Failure to do so can cause the CPU to repeatedly enter a dead loop, exacerbating the problem.

A vulnerability in the Linux kernel's PCI/MSI handling has been addressed, specifically for RISC-V and Loongarch platforms that lack proper PCI/MSI support. The issue arose because these platforms enabled legacy support without implementing the necessary fallbacks, leading to warnings during the MSI IRQ setup process. The vulnerability has been resolved by correcting the evaluation of legacy mode support and adding the missing checks in the MSI enable path.

A use-after-free vulnerability has been identified in the Linux kernel's Btrfs file system. The issue arises during the Copy-On-Write (COW) operation on tree blocks when tracing is enabled and preemption is allowed. Specifically, the vulnerability occurs in the 'btrfs_cow_block()' function, where the last reference to the extent buffer can be released before the corresponding tracepoint is executed. This premature release, managed by the Read-Copy Update (RCU) mechanism, can lead to a use-after-free condition, as the extent buffer may be freed before the tracepoint has completed its execution.

A denial-of-service vulnerability has been identified in the Linux kernel's Btrfs file system. The issue arises in the 'relocate_one_folio()' function, where the folio is unlocked after being read. This allows another thread to modify the folio's mapping before it is relocked, potentially leading to a null pointer dereference and a kernel crash. The vulnerability is particularly problematic when relocating data concurrently with transaction aborts, causing a crash by dereferencing a null pointer.

A vulnerability in the Linux kernel's Bluetooth subsystem, specifically within the Mediatek USB driver, has been addressed. The issue arose because the Mediatek driver did not properly release a USB interface used for ISO data transmission before unregistering the Bluetooth HCI device during a USB disconnect. This oversight could lead to a kernel panic when the Bluetooth USB dongle is removed, as the system attempted to unregister the HCI device without the interface being properly released.

A stack overflow vulnerability has been identified in Suricata, a network intrusion detection and prevention system, prior to version 7.0.8. This vulnerability arises from a large input buffer to various transform functions, including to_lowercase, to_uppercase, strip_whitespace, compress_whitespace, dotprefix, header_lowercase, strip_pseudo_headers, url_decode, and xor. The overflow can cause Suricata to crash.

A vulnerability allowing HTML injection has been identified in IBM UrbanCode Deploy (UCD) versions 7.2 through 7.2.3.13, 7.3 through 7.3.2.8, and IBM DevOps Deploy 8.0 through 8.0.1.3. This vulnerability could enable a user to inject arbitrary HTML tags into the Web UI, potentially leading to the disclosure of sensitive information.

A denial-of-service vulnerability has been identified in Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.x. This issue arises from an incorrect permission assignment for critical resources, allowing a locally authenticated attacker to potentially exploit the vulnerability.

A server-side request forgery (SSRF) vulnerability has been identified in FFmpeg's DASH playlist support, specifically in versions 4.2 through 6.0. This flaw allows arbitrary HTTP GET requests to be made from the machine running FFmpeg, using a crafted DASH playlist that contains malicious URLs. The vulnerability arises because the DASH demuxer does not properly check the protocol whitelist before initiating HTTP requests, potentially leading to unauthorized access or data exfiltration.

A denial-of-service vulnerability has been identified in FFmpeg versions 2.0 (at least) through 6.0 (latest). This issue arises in the HLS (HTTP Live Streaming) XBIN demuxer, where the absence of proper input format validation allows arbitrary data to be processed as XBIN-formatted. This exploitation leads to a significant increase in CPU usage during transcoding and creates excessively large output files, causing degraded performance. The vulnerability could be triggered by crafting an HLS playlist that bypasses file extension checks, directing FFmpeg to demux non-XBIN data as XBIN, which is then amplified into a larger file.

A vulnerability in FFmpeg's HLS demuxer allows for bypassing file extension checks that are meant to prevent unsafe files from being processed. This is achieved by appending certain file extensions to base64-encoded data URIs, which can then trigger arbitrary demuxers. The issue affects FFmpeg versions 2.0 through 6.0.

A cross-site scripting (XSS) vulnerability has been identified in the TabberNeue MediaWiki extension, specifically in versions prior to 2.7.2. The issue arises in the TabberTransclude.php file, where user-supplied page names are not properly escaped before being output. This flaw allows an XSS payload to be injected and executed. The vulnerability is present in the 'tabbertransclude' hook, which can be exploited by users who can edit pages or render wikitext.

A vulnerability in tgstation-server prior to version 6.12.3 allows enabled users to access most authorized API actions, regardless of their specific permissions. This issue arises because roles for authorizing API methods were incorrectly combined with the user-enabled role, allowing unauthorized access. However, the vulnerability does not affect the WriteUsers permission, preventing permanent elevation of account privileges.

A file upload conflict vulnerability has been identified in LangChain4j-AIDeepin versions prior to 3.5.0. The issue arises because the application uses MD5 to hash files, leading to potential conflicts during file uploads. This vulnerability has been addressed in version 3.5.0.

An open redirect vulnerability has been identified in Pnetlab version 5.3.11. This vulnerability allows an attacker to manipulate URLs, redirecting users to arbitrary external websites via a crafted script.

A Cross-Site Scripting (XSS) vulnerability exists in Pnetlab version 5.3.11. This issue allows attackers to inject malicious scripts into web pages, which are then executed in the context of the victim's browser. The vulnerability can be exploited by manipulating the 'success' parameter in the URL, particularly after registration, which triggers an application error message that executes the injected script.

A stored cross-site scripting vulnerability has been identified in IBM Sterling B2B Integrator Standard Edition versions 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2. This vulnerability allows users to inject arbitrary JavaScript into the Web UI, potentially altering functionality and leading to credential disclosure within a trusted session.

A stored cross-site scripting vulnerability has been identified in IBM Sterling B2B Integrator Standard Edition versions 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2. This vulnerability allows users to inject arbitrary JavaScript into the Web UI, potentially altering functionality and leading to credential disclosure within a trusted session.

A vulnerability exists in OpenVPN Connect for Android, prior to version 3.5.0, where the configuration profile's private key is stored in clear text and logged within the application. This exposed private key can be intercepted by an unauthorized actor and used to decrypt VPN traffic.

A vulnerability exists in OpenVPN versions prior to 2.6.11, where the software fails to properly sanitize PUSH_REPLY messages. This flaw allows an attacker controlling the server to inject unexpected arbitrary data into client logs. Additionally, this vulnerability could lead to a high CPU load on the client side.

A vulnerability allowing OS command injection has been identified in TUBITAK BILGEM Pardus OS My Computer, prior to version 0.7.2. This issue arises from improper neutralization of special elements used in OS commands, which could allow attackers to execute arbitrary commands on the operating system.

A buffer over-read vulnerability has been identified in the Automotive QNX OS used by Qualcomm. This vulnerability can lead to a transient denial-of-service condition when the GVM sends a specific message type to the Vdev-FastRPC backend.

A transient denial-of-service vulnerability has been identified in Qualcomm wireless drivers. The issue arises when the driver processes the per station (STA) profile information element (IE) and attempts to access the extended element ID without verifying the length of the IE first. This oversight can lead to a temporary disruption in service.

A vulnerability exists in the boot verification process of IFS2 images, allowing memory corruption. If a verified IFS2 image is overwritten, it can bypass boot verification. This vulnerability enables the injection of unauthorized programs into security-sensitive images, potentially allowing a tampered IFS2 system image to be booted.

A memory corruption vulnerability exists in certain Qualcomm products due to improper management of process-specific maps in relation to a global list. The issue arises when a map is removed from the global list while another thread is actively using it for a process-specific task, potentially leading to memory corruption.

A memory corruption vulnerability has been identified in the Qualcomm MCDM driver. This issue arises when any application that invokes IOCTL calls interacts with the MCDM driver, leading to potential memory corruption.

A memory corruption vulnerability has been identified in Qualcomm products while processing FIPS encryption or decryption validation through a specific IOCTL call. This issue could potentially be exploited to cause unintended behavior in the affected system.

A buffer copy vulnerability has been identified in the Windows WLAN Host component of certain Qualcomm chipsets. This vulnerability, classified as a 'classic buffer overflow', arises from memory corruption while processing IOCTL calls invoked from user space. The issue specifically relates to the verification of non-extension FIPS encryption and decryption functionality, creating potential for memory corruption.

A memory corruption vulnerability has been identified in the Windows WLAN Host component of certain Qualcomm chipsets. This issue arises from a buffer over-read while processing FIPS encryption or decryption IOCTL calls initiated from user-space. The vulnerability could potentially be exploited to cause memory corruption, leading to undefined behavior in the application.

A memory corruption vulnerability has been identified in the WLAN driver, triggered by an IOCTL call from user-space that writes board data. This issue could potentially be exploited to cause unintended behavior in the driver.

A memory corruption vulnerability has been identified in the Windows WLAN Host component of various chipsets. This issue arises when an IOCTL call is made from user-space to read board data, leading to improper memory handling.

A vulnerability exists in certain Qualcomm drivers, applications, or SMMU clients that allows for uncontrolled resource consumption. This issue arises when these entities attempt to access global registers through the SMMU, potentially leading to performance degradation or resource exhaustion.

A buffer over-read vulnerability has been identified in various chipsets of Qualcomm Snapdragon products, specifically within the Automotive Autonomy technology area. This vulnerability allows information disclosure while invoking the mailbox read API, potentially leading to unauthorized access to sensitive data.

A buffer over-read vulnerability has been identified in the audio component of certain Qualcomm chipsets. This vulnerability allows for information disclosure by invoking the callback function of the sound model driver from the Audio Digital Signal Processor (ADSP). The issue arises for every valid opcode received from the sound model driver, leading to the unintentional exposure of sensitive information.

A vulnerability has been identified in certain Qualcomm products that allows for information disclosure. This issue arises when processing IOCTL calls related to releasing a trusted virtual machine process or opening a channel without properly initializing the process. As a result, sensitive information may be inadvertently exposed.

A memory corruption vulnerability has been identified in certain Qualcomm products, arising from the handling of frame command IOCTL calls. This issue could potentially be exploited to cause unintended behavior or damage to memory.

A use-after-free vulnerability has been identified in various chipsets of Qualcomm products, including those in the Automotive Software platform based on QNX, Windows WLAN Host, and several chipsets used in mobile and automotive applications. This vulnerability allows memory corruption by improperly managing DMA buffers during IOCTL operations, which could potentially be exploited to cause unauthorized memory access or manipulation.

A memory corruption vulnerability has been identified in certain Qualcomm chipsets within the computer vision component. This issue arises from a lack of input parameter validation for the number of fences in fence frame IOCTL calls, which can lead to memory corruption.

A vulnerability allowing information disclosure has been identified in Qualcomm automotive chipsets. This issue arises when the mailbox write API is invoked with messages larger than the mailbox size, leading to unintended information exposure.

A buffer overflow vulnerability has been identified in various chipsets of Qualcomm products, including those in the Snapdragon 8 Gen 3 Mobile Platform and several Windows WLAN Host chipsets. This vulnerability allows for memory corruption by processing IPA statistics when no active clients are registered, potentially leading to unauthorized memory access or manipulation.

A SQL injection vulnerability has been identified in the Email Subscribers by Icegram Express WordPress plugin, affecting versions prior to 5.7.44. The issue arises because the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement. This oversight enables administrators to execute SQL injection attacks.

A stored cross-site scripting vulnerability has been identified in the Icegram Engage WordPress plugin, affecting versions prior to 3.1.32. The issue arises because the plugin fails to properly sanitize and escape certain campaign settings, potentially allowing users with author privileges and above to inject malicious scripts that are stored and executed later.

A stored cross-site scripting vulnerability has been identified in the Pods WordPress plugin, affecting versions prior to 3.2.8.1. The issue arises because the plugin fails to properly sanitize and escape certain settings. This flaw enables high-privilege users, such as administrators, to execute stored cross-site scripting attacks, even in environments where the unfiltered_html capability is restricted, such as multisite setups.

A cross-site scripting (XSS) vulnerability has been identified in the Tourmaster WordPress plugin, affecting versions prior to 5.3.4. The issue arises because the plugin fails to properly sanitize and escape certain parameters before displaying them on the page. This oversight could enable unauthenticated users to execute XSS attacks.

A critical out-of-bounds write vulnerability has been identified in the Modem component of various MediaTek chipsets. This issue arises from a missing bounds check, which could allow remote code execution. The vulnerability can be exploited if a user equipment (UE) connects to a rogue base station controlled by an attacker. Notably, no additional execution privileges are required for exploitation, and user interaction is not needed.

A vulnerability exists in the WLAN STA driver that allows a client to be deceived into connecting to an access point (AP) with a fake SSID. This could result in remote information disclosure without requiring additional execution privileges. Exploitation does not need user interaction.

A vulnerability has been identified in the MediaTek WLAN Station (STA) driver, where improper exception handling creates a reachable assertion. This issue could lead to a local denial-of-service condition, but only if the attacker has already gained system privileges. Exploitation does not require user interaction.