CVE Vulnerability Catalog

In the Linux kernel, the iwlwifi driver's debug actions order was implemented incorrectly. The fix splits the dump and performs FW reset only in the middle of the dump, rather than the FW killing itself on error. As a result, some actions when applying the config may crash the device, so the order needs fixing.

A bug was fixed in the Linux kernel's dmaengine ti k3-udma-glue driver, which incorrectly managed FDQ (Free Descriptor Queue) in RX channels. The skip_fdq argument was replaced with an internal 'single_fdq' flag inferred from the DMA architecture, preventing warnings and errors when unloading the ti_am65_cpsw_nuss module on the AM62-SK platform.

In the Linux kernel, an issue was fixed in clk: sunxi-ng: h616 where changing the GPU frequency without reparenting the clock caused panfrost oopses and GPU hangs. The fix reparents the GPU clock to GPU1 during frequency changes.

In the Linux kernel, the cpufreq amd-pstate driver's set_boost function uses an unnecessary driver-wide lock. This lock can collide with the lock in the mode-switch path in status_store(), potentially leading to a deadlock.

In the Linux kernel, a vulnerability was resolved in drm/xe/vf: early GT MMIO initialization is needed to read GMDID. Due to refactoring, gt->mmio was initialized later, and attempts by VF to use xe_mmio_read/write from GuC functions led to an NPD crash due to unset MMIO register address.

In the Linux kernel, a vulnerability was resolved related to Rust incompatibility with FineIBT (CFI). Calling core::fmt::write() from Rust code with FineIBT enabled causes a kernel panic due to a Control Flow Integrity violation. The fix makes CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88.

A flaw in the Linux kernel's KASAN implementation causes apply_to_pte_range() to invoke kasan_populate_vmalloc_pte() in atomic context (with preemption disabled), potentially attempting to sleep during page allocation. On s390 this triggers a "BUG: sleeping function called from invalid context" warning and may cause instability. The fix bulk-allocates shadow memory before invoking the callback.

In the Linux kernel, the MCTP implementation's mctp_dump_addrinfo can access ifa_index when the ifaddrmsg structure is not provided, comparing against uninitialized memory. This is reproducible via dhcpd or busybox "ip addr show". Since the MCTP implementation has always filtered by ifa_index, existing userspace programs should pass a valid ifa_index value (0 or a real index).

A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service.

A vulnerability was found in the XFIXES extension where the XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.

Klasa html.parser.HTMLParser miała najgorszą złożoność kwadratową podczas przetwarzania niektórych specjalnie przygotowanych, źle sformatowanych danych wejściowych, co mogło prowadzić do wzmocnionego ataku typu denial-of-service.

A path traversal vulnerability exists in Erlang/OTP stdlib's zip functions (zip:unzip/1,2 and zip:extract/1,2) unless the memory option is used. This allows file manipulation outside the target directory.

In GIMP, the "Despeckle" plug-in has an integer overflow vulnerability. Unchecked multiplication of image dimensions (width, height, bytes-per-pixel) can cause insufficient memory allocation and out-of-bounds writes.

A zip path traversal vulnerability exists in the module installation process of Mendix Studio Pro 9, 10, 11 and 11.12 (Windows and Mac versions). By crafting a malicious module and distributing it via the Mendix Marketplace, an attacker could write or modify arbitrary files outside a developer's project directory.

Mattermost versions 10.7.x <= 10.7.1, 10.6.x <= 10.6.3, 10.5.x <= 10.5.4, and 9.11.x <= 9.11.13 fail to properly validate LDAP group ID attributes. An authenticated administrator with PermissionSysconsoleWriteUserManagementGroups can execute LDAP search filter injection via the PUT /api/v4/ldap/groups/{remote_id}/link API when objectGUID is configured as the Group ID Attribute.

Cross-Site Scripting (XSS) vulnerability in Jetimob Plataforma Imobiliaria version 20240627-0. An attacker can inject malicious script via the "Profisso" field in the "Pessoas" section.

A Cross-Site Scripting (XSS) vulnerability was found in Jetimob Plataforma Imobiliaria version 20240627-0. The 'Descrico' form field in the 'Oportunidades' section during activity creation or editing allows JavaScript injection.

Cross-Site Scripting (XSS) vulnerability in Jetimob Plataforma Imobiliaria allows an attacker to inject malicious script into the 'Título' (title) field within the filter save option of the 'Busca' (search) function.