CVE Vulnerability Catalog

A vulnerability related to the tile info buffer size in the AV1 module for Verisilicon has been fixed in the Linux kernel. The issue involved incorrect memory allocation for tile information, which could lead to operational errors.

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerable to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.

Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URLs to be handled by mod_proxy.

A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content.

An out-of-bounds read vulnerability exists in libpoppler.so in Poppler through version 24.12.0 within the JBIG2Bitmap::combine function in JBIG2Stream.cc.

A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause application crashes when handling malformed inputs associated with INT_MIN.

Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc due to a misplaced isOk check.

NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify adbe.pkcs7.sha1 signatures on documents, allowing potential signature forgeries.

Incomplete tracking in PostgreSQL of tables with row security allows reused queries to view or change different rows than intended. Fixes for CVE-2023-2455 and CVE-2016-2193 missed cases involving subqueries, WITH queries, and security invoker views.

Client use of server error messages in PostgreSQL allows an untrusted server under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. A man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql might misinterpret.

Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows than intended. The attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or equivalent. The problem arises when application queries use partitioning.

Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g., PATH). This often suffices for arbitrary code execution, even without a database server OS user account.

A vulnerability related to NULL pointer dereference in the ASoC: SOF: Intel: hda module has been fixed in the Linux kernel. The issue occurs when there is a mismatch between the DAI links in the machine driver and the topology, potentially leading to the playback/capture widget not being set, especially in loopback scenarios.

Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise see.

A TOCTOU race condition in pg_dump in PostgreSQL allows an object creator to replace another relation type with a view or foreign table, executing arbitrary SQL functions as the user running pg_dump, often a superuser. The attack requires waiting for the right moment.

A buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to cause temporary denial of service on platforms where a 1-byte over-read leads to process termination. This affects the database server and libpq.

The urllib.parse.urlsplit() and urlparse() functions in Python improperly validate bracketed hosts (`[]`), accepting hosts that are not IPv6 or IPvFuture. This violates RFC 3986 and could enable SSRF attacks if a URL is processed by multiple URL parsers.

A medium severity vulnerability in CPython where regular expressions allow excessive backtracking during tarfile.TarFile header parsing, leading to ReDoS via specially crafted tar archives.

A high severity vulnerability in the CPython zipfile module affecting zipfile.Path. When iterating over entry names in a zip archive (e.g., namelist(), iterdir()), unexpected behavior may occur. The more common zipfile.ZipFile class is unaffected.

A vulnerability in the Linux kernel related to the lack of error checking for the kcalloc() function in parse_thread_groups() has been resolved. The absence of this check could lead to a NULL pointer dereference.