CVE Vulnerability Catalog

The tokenizer incorrectly interprets tags with unquoted attribute values ending with a solidus character (/) as self-closing. When directly using Tokenizer, this can incorrectly mark such tags as self-closing, and when using Parse functions, content following such tags may be placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g., <math>, <svg> contexts).

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, and 9.11.x <= 9.11.9 fail to properly enforce the 'Allow users to view/update archived channels' System Console setting. Authenticated users can view members and member information of archived channels even when this setting is disabled.

In the Linux kernel, the int340x thermal driver lacked a NULL check for the ACPI device pointer (adev), which could lead to a NULL pointer dereference in int3402_thermal_probe(). A check has been added, returning -ENODEV if adev is NULL.

In the Linux kernel, a flaw exists in the RISC-V KVM module: during module removal, aia_exit is called before kvm_exit, so the AIA per-CPU IRQ is not properly disabled. This triggers a kernel warning and leaves the IRQ in an inconsistent state, preventing the KVM module from being reinserted.

In the Linux kernel's DLM (Distributed Lock Manager), a vulnerability leads to a NULL pointer dereference (NPD). When a positive value is written to the event_done file, the new_lockspace function undoes all work, leaving lockspace uninitialized. The __dlm_new_lockspace function incorrectly treats this positive value as success, passing a NULL pointer to dlm_find_lockspace_local, causing a crash.

In the Linux kernel, the ath11k WiFi driver has a warning issue when freeing IRQs in the error path. When a shared IRQ is used, the affinity hint is not cleared before calling ath11k_pcic_free_irq(), causing a warning.

In the Linux kernel, a vulnerability exists in the F2FS file system where the prepare_compress_overwrite() function can enter an infinite loop when reading compressed pages due to an I/O error. This causes a kernel hang because the function holds the .writepages lock, blocking other writeback tasks.

In the Linux kernel, the idpf driver ignores the error code from register_netdev() during initialization. As a result, a WARN_ON() is triggered on unregister attempts and the user gets no indication that netdev creation failed.

In the Linux kernel, unnecessary RTNL lock operations were removed for SIOCBRADDIF and SIOCBRDELIF ioctls, which caused deadlocks and warnings about waiting for network device release. The issue occurred when one thread detached an interface from a bridge while another tried to remove the bridge, leading to a lockup and 'unregister_netdevice: waiting' splat.

W jądrze Linuxa zidentyfikowano podatność związaną z trybem bondingu, która może prowadzić do ostrzeżeń podczas zmiany trybu bondingu po podłączeniu programu XDP. Problem występuje, gdy tryb bondingu jest zmieniany po przypisaniu programu XDP, co może skutkować nieprawidłowym działaniem.

In the Linux kernel, there is a NULL pointer dereference vulnerability in l3mdev_l3_rcv(). When deleting an ipvlan interface in l3s mode, dev->l3mdev_ops is set to NULL, which can cause a crash during packet processing.

In the Linux kernel, the libwx driver has a bug in Tx L4 checksum calculation. Hardware only supports L4 checksum offload for TCP/UDP/SCTP, but the flag was set for other protocols, causing Tx ring hang.

In the Linux kernel, the PCI brcmstb driver has a vulnerability where the number of regulators is not set to zero after a regulator_bulk_get() error. If the PCIe link fails, a subsequent regulator_bulk_free() call causes a kernel panic.

In the Linux kernel, a NULL pointer dereference occurs in the 9p filesystem when creating a directory (mkdir) if the 9p tree is mounted with the 'posixacl' option and the parent directory has a default ACL set. The function v9fs_vfs_mkdir_dotl() calls v9fs_fid_add(), which sets the 'fid' pointer to NULL, and then v9fs_set_create_acl() attempts to use that pointer, causing a kernel crash.

In the Linux kernel, the mvpp2 driver has a vulnerability that can corrupt the parser TCAM memory. Concurrent access to TCAM and SRAM index registers without proper locking can cause writes to wrong rows and TOCTOU errors during row allocation. This was observed when mvpp2_set_rx_mode() ran on two CPUs simultaneously, corrupting the MVPP2_PE_MAC_UC_PROMISCUOUS entry and dropping all incoming unicast traffic.

In the Linux kernel, the ibmveth driver's veth_pool_store function lacked synchronization, allowing multiple threads to concurrently call napi_disable and cause a system hang. The issue occurred when writing to /sys/devices/vio/.../pool*/* files simultaneously. The fix uses rtnl_mutex to synchronize veth_pool_store with ibmveth_open and ibmveth_close.

A vulnerability has been identified in the Linux kernel concerning the nfsd_proc_stat_init() function, which ignores the return code from svc_proc_register(). If the procfile creation fails, the kernel issues a warning when attempting to remove the entry later.

In the Linux kernel, the ath11k WiFi driver has an RCU stall issue while processing the monitor destination ring. When the driver cannot obtain a valid buffer for a buf_id from hardware, an infinite loop occurs, leading to a kernel crash.

In the Linux kernel, a read-only check was added before calling txBeginAnon in extAlloc and extRecord in the JFS filesystem. This prevents modification attempts on a read-only mounted filesystem, avoiding potential errors or crashes.

Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform constant-time comparison on the MSTeams plugin webhook secret. This allows an attacker to retrieve the webhook secret via a timing attack during webhook secret comparison.