CVE Vulnerability Catalog

In the Linux kernel, the mvpp2 driver has a vulnerability that can corrupt the parser TCAM memory. Concurrent access to TCAM and SRAM index registers without proper locking can cause writes to wrong rows and TOCTOU errors during row allocation. This was observed when mvpp2_set_rx_mode() ran on two CPUs simultaneously, corrupting the MVPP2_PE_MAC_UC_PROMISCUOUS entry and dropping all incoming unicast traffic.

A vulnerability in the Linux kernel allows integer overflow in the geneve_opt structure. An attacker can use a 128-byte option to fake a zero-length option, leading to a heap out-of-bounds read.

A vulnerability has been identified in the Linux kernel concerning the nfsd_proc_stat_init() function, which ignores the return code from svc_proc_register(). If the procfile creation fails, the kernel issues a warning when attempting to remove the entry later.

A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes.

A NULL pointer dereference vulnerability was found in the SoupAuthDigest authentication mechanism of the libsoup library. A malicious HTTP server can exploit this flaw to crash the libsoup client.

A flaw was found in libsoup, where soup_auth_digest_authenticate() is vulnerable to a NULL pointer dereference. This issue may cause the libsoup client to crash.

A flaw was found in libsoup's SoupContentSniffer, specifically in the sniff_mp4 function, which may cause a NULL pointer dereference. A malicious HTTP server can exploit this to crash the libsoup client.

A flaw was found in the libsoup library in the implementation of HTTP range requests. It allows a malicious client to request the same range multiple times in a single HTTP request, causing excessive memory consumption on the server. This vulnerability does not enable a full denial of service.

The vulnerability in Apache ActiveMQ Artemis involves the insertion of sensitive information into the log file. All broker property values are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has debug level enabled.

A vulnerability was found in the Linux kernel's memory migration mechanism (mm/migrate). The bug incorrectly determines the number of xarray entries to update during shmem folio migration, causing multi-index entry corruption. The issue occurs when __folio_migrate_mapping() uses folio_test_swapbacked() instead of folio_test_swapcache() to distinguish between page cache and swap cache folios.

A security flaw in WildFly and JBoss EAP in the EJB remote invocation mechanism results from untrusted data deserialization by JBoss Marshalling. It allows an attacker to send a specially crafted object, leading to remote code execution without authentication.

A flaw was found in the libsoup library in the sniff_feed_or_html() and skip_insignificant_space() functions, which may lead to a heap buffer over-read.

A flaw was found in the libsoup library in the sniff_unknown() function, which may lead to a heap buffer over-read. This vulnerability could allow an attacker to read sensitive data from memory.

A flaw was found in the libsoup library in the soup_uri_decode_data_uri() function, which may crash when processing malformed data URIs. This vulnerability allows an attacker to cause a denial of service (DoS).

A flaw was found in the libsoup library in the append_param_quoted() function, which may cause a buffer overflow and under-read.

A memory leak was found in the Linux kernel's fib_check_nh_v6_gw() function for IPv6. The issue occurred after moving fib_nh_common_init() before pcpu memory allocation, leaving nhc_pcpu_rth_output uncleaned on allocation failure.

A flaw in Tempo Operator where enabling Jaeger UI Monitor Tab creates a ClusterRoleBinding for the Tempo service account, granting cluster-monitoring-view role. A user with permissions to create TempoStack and read secrets in a namespace can read the service account token and access all cluster metrics.

A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users' permissions.

In the Linux kernel's netfilter subsystem (nf_conncount), a vulnerability was found due to uninitialized fields in the `nf_conncount_tuple` structure within the `insert_tree()` function. Missing initialization of `cpu` and `jiffies32` fields can lead to undefined behavior, including information leaks or system crashes.

A vulnerability in the Linux kernel's MPTCP implementation allows concurrent connection requests to trigger synchronize_rcu in an atomic context (e.g., during packet reception in an RCU read-side critical section). This causes a 'scheduling while atomic' error and potential system hang.