CVE Vulnerability Catalog

A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes the Authorization header but does not remove the Proxy-Authorization header if the request is redirected to a different host. As a result, sensitive proxy credentials may be leaked to third-party servers.

A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF sequences into the header value. These sequences are interpreted verbatim when the HTTP request or response is constructed, allowing arbitrary HTTP headers to be injected.

pypdf is a free and open-source pure-python PDF library. An infinite loop vulnerability present in versions prior to 6.6.2 can be triggered by a crafted PDF when accessing the outlines/bookmarks. This has been fixed in pypdf 6.6.2.

The _ux_host_class_storage_media_mount() function mounts partitions on a USB mass storage device and, upon encountering an extended partition entry, recursively calls itself to mount the next logical partition. There is no limit on recursion depth or tracking of visited sectors, so a malicious or malformed disk image can include cyclic or excessively deep chains of extended partitions, causing stack overflow.

W GLib znaleziono lukę, która polega na przepełnieniu całkowitym w implementacji konwersji wielkości liter Unicode. Przetwarzając specjalnie przygotowane i niezwykle duże ciągi Unicode, atakujący może wywołać niewłaściwą alokację pamięci, co prowadzi do zapisów poza przydzielonym obszarem pamięci.

W bibliotece GLib znaleziono błąd w procedurze kodowania Base64, który występuje podczas przetwarzania bardzo dużych danych wejściowych. Niewłaściwe użycie typów całkowitych podczas obliczania długości może prowadzić do błędnego obliczenia granic bufora, co skutkuje zapisem pamięci poza przydzielonym buforem.

A flaw was found in libsoup, an HTTP client library. This CRLF injection occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to create the Host header. A remote attacker can provide a specially crafted URL containing CRLF sequences to inject additional HTTP headers or complete HTTP request bodies.

go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (repoName) as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map file from an untrusted source, an attacker can supply a repoName containing traversal (e.g., ../escaped-repo) and cause go-tuf to create directories and write the root metadata file outside the intended LocalMetadataDir cache base, within the running process's filesystem permissions. Version 2.4.1 contains a patch.

A flaw was found in the GnuTLS library in the gnutls_pkcs11_token_init() function handling PKCS#11 token initialization. Processing a token label longer than expected causes a stack buffer overflow, potentially leading to application crashes or code execution.

A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection, which may lead to leaking connections from the database connection pool and potentially cause a Denial of Service (DoS) by exhausting available database connections.

A flaw in the mapstructure library for Go causes information disclosure through detailed error messages. The WeakDecode function may leak sensitive input values in error messages when processing malformed data.

A vulnerability in the Linux kernel's IP over GRE (ip_gre) driver allows a system crash via kernel panic due to insufficient buffer space checks before adding the GRE header. This can be triggered by specially crafted network traffic, leading to a skb_under_panic error.

In the Linux kernel, the xhci driver's xhci_sideband_remove_endpoint() incorrectly assumed the endpoint was running and had a valid transfer ring, leading to dereferencing a freed or non-existent 'ep->ring'. The fix removes unnecessary ring access, checks that ep->ring exists before dereferencing, and ensures the endpoint is running before attempting to stop it.

In the Linux kernel, the drm/vmwgfx driver on HW version 10 did not have GB surfaces, so there was no backing buffer for surface-backed framebuffers. This resulted in a null pointer dereference and driver crash causing a black screen.

In the Linux kernel, the auto-generated integrity buffer for writes was not fully initialized when metadata size exceeded the PI tuple. Uninitialized memory (the "opaque" portion) could be read back by userspace or someone with physical access to the device. The fix generalizes the BLK_INTEGRITY_CSUM_NONE check to zero the entire buffer.

A vulnerability in the Linux kernel's XSAVE/XRSTOR mechanism for KVM virtual machines was found. When XSTATE_BV indicates an enabled feature that is disabled by XFD, attempting to restore that state via XRSTOR causes a #NM fault and kernel panic. This occurs when loading guest state via KVM_SET_XSAVE or updating XFD in response to guest WRMSR.

In the Linux kernel, lib/buildid has a NULL pointer dereference bug in filemap_read_folio. In sleepable context, freader uses direct page cache access via read_cache_folio() instead of __kernel_read(), causing a crash.

In the Linux kernel net/mlx5e driver, mlx5e_netdev_change_profile may fail to roll back to the old profile after a failed profile change, leaving a dangling netdev with reset priv. A subsequent profile change attempt (e.g., re-enabling switchdev mode) dereferences NULL priv->mdev and crashes the kernel.

In the Linux kernel, the net/mlx5e driver stores a pointer to the unstable mlx5e_priv structure in the mlx5e_dev devlink private data. If profile initialization fails (e.g., when switching eswitch to switchdev mode), mlx5e_priv can be zeroed, leading to a NULL pointer dereference and kernel oops in mlx5e_remove during device removal.

In the Linux kernel, a vulnerability in the idxd DMA driver causes device reference leaks during compat bind and unbind operations. Failure to release references leads to improper memory management.