CVE Vulnerability Catalog

In the Linux kernel, in the Btrfs filesystem, an issue with readahead on the relocation inode was fixed when the filesystem uses a RAID stripe tree (RST), which could cause ENOENT errors.

In the Linux kernel, in the NFS server (nfsd), a race between the laundromat thread and the free_stateid operation was fixed, which could lead to incorrect handling of expired delegations.

Axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON, the helper behind the public axios.formToJSON() / named formToJSON API and the default request transform used when FormData is sent with an application/json content type.

Vulnerability in the iscsi-initiator-utils package involves out-of-bounds write and information disclosure via unvalidated IPv6 payload length. Crafted ICMPv6 Echo requests can cause the iscsiuio daemon to trust an inflated ipv6_plen larger than the actual received payload.

Axios versions starting with 0.28.0 contain uncontrolled recursion in formDataToJSON, which is exposed as axios.formToJSON() and used internally when axios serialises FormData with Content-Type: application/json. If an application passes attacker-controlled FormData field names, it can lead to stack exhaustion.

Node-tar (npm tar) contains an uncontrolled recursion stack-exhaustion DoS in the internal mapHas helper used by filesFilter. Calling tar.t(...) or tar.x(...) with a non-empty member-selection list installs a filter that closes over the recursive mapHas.

An out-of-bounds read was found in the NC-SI OEM response handler of libslirp. A truncated NC-SI OEM Ethernet frame causes ncsi_rsp_handler_oem() to read up to 4 bytes beyond the supplied packet length and reflect the value into the response sent to the guest, resulting in guest-observable disclosure.

In the Linux kernel, the Bluetooth subsystem (hci_core) now disables works during hci_unregister_dev because the hci_dev is about to be freed and new submissions should not be allowed.

A vulnerability in the Mail library affects the q_value_decode and b_value_decode functions, which decode only the first RFC 2047 encoded-word in a string and use an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause incorrect decoding.

In the Linux kernel, a double accounting race was fixed in Btrfs when btrfs_run_delalloc_range() fails. The issue occurs when block size is smaller than page size and can lead to kernel crash.

The iscsi-initiator-utils package version 6.2.1.11-0.git4b3e853.el10 has a stack buffer overflow vulnerability in idbm_recinfo_config. A malicious iSCSI target can inject an extra configuration line into a persisted node record via a crafted SendTargets TargetName, later causing a stack buffer overflow.

The decNumberCopy function in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write. This can be demonstrated by using --slurp with subtraction, such as a filter of .-. when the input has a certain form.

In the Linux kernel, a vulnerability was found in the tracing mechanism where trace_event_file lacks reference counters. This can lead to use-after-free and kernel crash.

In the Linux kernel, the Android Binder driver no longer stores a pointer to a VMA for later use outside the mmap_lock. This was unsafe because the pointer could reference freed memory.

In the Linux kernel's networking subsystem, a dangling sk pointer is left when socket creation fails, potentially leading to use-after-free when __sock_release() is called with an fentry probe.

In the Linux kernel, a race condition was fixed in the OA TC6 network driver between reference pointers for TX packets. The issue involves managing two skb pointers for packets enqueued from the network stack.

Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted Object.prototype. The top-level merged config is protected with a null prototype, but nested plain objects such as auth and paramsSerializer are cloned into objects with a prototype.

Axios is vulnerable to read-side prototype-pollution gadgets when Object.prototype has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: axios.get(), axios.delete(), axios.head(), and axios.options().

A low-privilege authenticated Samba AD user can modify internal LDB special DNs via LDAP access, enabling a domain takeover.

In the Linux kernel, in the Bluetooth subsystem (hci_conn), the function disable_delayed_work_sync is used instead of cancel_delayed_work_sync, which not only cancels ongoing work but also disables new submissions, which is desirable.