CVE Vulnerability Catalog

A vulnerability classified as problematic was found in GNU Binutils 2.45. Affected is the function copy_section of the file binutils/objcopy.c, leading to a heap-based buffer overflow. Attacking locally is a requirement, and the exploit has been disclosed to the public and may be used.

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive containing a ../ symlink to a critical directory. Second, the victim must extract an archive containing a critical file specified via a relative pathname that begins with the symlink name and ends with the critical file's name, bypassing the 'Member name contains ..' protection.

Produkty Emerson ValveLink przyjmują dane wejściowe, ale nie weryfikują lub błędnie weryfikują, czy te dane mają wymagane właściwości do bezpiecznego i poprawnego przetwarzania.

A NULL pointer dereference flaw was found in the GnuTLS library in the _gnutls_figure_common_ciphersuite() function.

An XSS vulnerability in the Admin Login page of Allworx System Software v9.1.9.12 allows attackers to inject arbitrary web scripts or HTML via the SessionID parameter in query.asp.

A heap-buffer-overflow (off-by-one) vulnerability was found in the GnuTLS software in the template parsing logic of the certtool utility. An attacker can exploit this to cause an out-of-bounds NULL pointer write, leading to memory corruption and a denial-of-service (DoS) that could crash the system.

A bug in the Linux kernel causes a crash in the icl_update_topdown_event() function on Intel RaptorLake machines. The issue occurs when the function is invoked on E-core CPUs that do not support the perf metrics feature, leading to a general protection fault and system hang. The bug was introduced by commit f9bdf1f95339, which mistakenly replaced is_topdown_count() with is_topdown_event().

In the Linux kernel, the iavf driver's crit_lock mechanism was removed because it caused deadlocks during virtual function (VF) removal and reset. It was replaced with netdev_lock and the work cancellation scheme was changed to avoid synchronization errors.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the ASoC driver for MediaTek MT8195. When no codec is assigned to ETDM2_IN_BE and ETDM1_OUT_BE links in the device tree, the strcmp function receives a null pointer, causing a kernel panic.

In the Linux kernel, the DSA b53 driver was fixed to avoid enabling EEE on BCM63xx internal switches, which do not support EEE. This could hang the system when accessing non-existent EEE registers if an external EEE-capable PHY is connected to an RGMII port.

In the Linux kernel, in pinctrl drivers for MediaTek v1 platforms, there is a bug causing an invalid pointer dereference. The mtk_eint_do_init() function tries to access the 'soc' field in the mtk_pinctrl structure, which does not exist in the definition used by v1 drivers, causing a system crash during boot, e.g., on Genio 350 EVK (MT8365).

A heap-buffer-overread vulnerability was found in GnuTLS when handling the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows an attacker to create a certificate with a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that may contain sensitive data. As a result, confidential information may be exposed when GnuTLS verifies certificates from certain websites if the SCT is not checked correctly.

A double-free vulnerability was found in GnuTLS in the export logic of Subject Alternative Name (SAN) entries containing an otherName. The flaw is due to incorrect ownership handling of ASN.1 nodes, leading to a double-free condition when the parent function later attempts to free the same structure.

Insufficient permission checks on critical fields within Bluetooth Low Energy (BLE) data packets were discovered in Texas Instruments CC2652RB LaunchPad SimpleLink CC13XX CC26XX SDK 7.41.00.17. This vulnerability allows an attacker to cause a Denial of Service (DoS) via a crafted LL_Length_Req packet.

The Realtek RTL8762E SDK V1.4.0 was found to have insufficient permission checks on critical fields in Bluetooth Low Energy (BLE) data packets. This vulnerability allows an attacker to cause a Denial of Service (DoS) via a crafted LL_Length_Req packet.

SQL Injection vulnerability in Abis, Inc Adjutant Core Accounting ERP build PreBeta250F allows a remote attacker to obtain sensitive information via the cid parameter in a GET request.

FortiOS and FortiProxy have a vulnerability related to improperly implemented security checks that may allow a remote unauthenticated user to bypass the DNS filter using Apple devices.

In the Linux kernel, the exynos4-is camera platform driver's fimc_is_hw_change_mode() function changes camera modes without waiting for hardware completion, risking corrupted data or system hangs. Hardware synchronization has been added to ensure stability.