CVE Vulnerability Catalog

A vulnerability in Poly Voice IP devices (CCX, Trio, Edge E) may render them inoperable when connecting to a malicious SIP server and receiving malformed data. HP is releasing updates to mitigate this risk.

A vulnerability in the Feast Feature Server's `/save-document` endpoint allows an unauthenticated remote attacker to write arbitrary JSON files to the server's filesystem. Despite location restrictions, these can be bypassed, enabling overwriting of critical application configurations or startup scripts.

Multiple unbounded alloca() calls in the PulseAudio protocol server can lead to stack overflow and potential arbitrary code execution.

The RAOP module accepts unbounded Content-Length values and does not check the return value of pw_array_add().

A chain of vulnerabilities was found in pretix: payment plugins (Stripe, Mollie, OPPWA, BitPay, Payone, SecuConnect, Sofort, Saferpay) do not validate session parameters beyond cryptographic signature, the redirect feature uses the same key and salt for signing as the plugins, and the admin impersonation feature allows changing user after injecting arbitrary parameters. An attacker with access to at least one event can become any backend user and access all data.

A vulnerability in the PrivilegedHelperTool XPC service in Cato Client before version 5.13.1 on macOS is caused by improper certificate validation and a TOCTOU race condition. This allows a local authenticated attacker to escalate privileges to root using a self-signed certificate and a symlink swap during package installation.

The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member.

The PrivateContent WordPress plugin contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 9.9.2.

In the Linux kernel's drm/i915/gem driver, a bug was found in the pread/pwrite functions for physical buffer objects (phys BO). The sg_page() function returns a struct page pointer, not void*, causing incorrect offset scaling during read/write. As a result, with a non-zero offset, wrong parts of the buffer are accessed.

Vulnerability in the Linux kernel in the RDS IB driver. During failed connection setup (rds_ib_setup_qp), the i_sends pointer is not cleared after memory free, potentially leading to use-after-free on subsequent shutdown.

In the Linux kernel for ARM64, a mitigation was added for errata affecting TLBI instructions on certain Arm CPUs. The bug causes a TLBI;DSB sequence to complete before global observation of writes translated by an invalidated TLB entry. Although TLB invalidation is correct, memory access after invalidation may be incomplete.

In the Linux kernel, the WARN_ONCE() in hsr_addr_is_self() has been removed because it triggered a false positive when an HSR interface was being deleted. The self_node pointer is cleared before the network device is fully unregistered, causing an unnecessary warning.

A race condition in the Linux kernel's zap_other_threads() function fails to clear JOBCTL_PENDING_MASK for the calling thread during execve(). This causes a stale stop signal after execve completes, triggering a kernel warning and potential system instability.

A fix in the Linux kernel resolves a warning during core dump on RISC-V. The issue was using the wrong register note type for REGSET_CFI.

In the Linux kernel, a NULL pointer dereference occurs in the wm_adsp driver when removing firmware controls. The wm_adsp_control_remove() function attempts to clean up private data without checking if the priv pointer is NULL.

In the Linux kernel, a vulnerability in netfilter nf_conntrack causes nf_ct_helper_expectfn_unregister() to not remove pending expectations from the table, leaving a dangling pointer to freed module code. When the expected connection arrives, invoking this pointer results in a kernel crash.

A NULL pointer dereference vulnerability was found in the Linux kernel's ASoC SDCA driver during function unregistration. When a function registration fails partially or device cleanup races with probe deferral, func_dev entries may be NULL, causing a kernel oops with BUG message.

In the Linux kernel, the virtio-gpu driver has an issue during driver removal when KMS is disabled. DRM atomic and modesetting are not initialized, leading to access of uninitialized data and kernel crash.

In the Linux kernel for ARM64 in Rust code, a bug was found related to the LLVM uwtable module flag. Due to a rustc bug, the -Cforce-unwind-tables=y flag does not emit the uwtable annotation for the module, causing compiler-generated functions (e.g., asan.module_ctor) to lack the annotation. When CONFIG_UNWIND_PATCH_PAC_INTO_SCS is enabled, this leads to boot failures due to incorrect patching of paciasp/autiasp instructions.

In the Linux kernel, a false positive WARN was removed when marking a page as dirty while the VM is dying. The issue affected SEV-ES guests where KVM kept a writable mapping of a guest page after an exit to userspace and tried to unmap it during vCPU destruction, triggering a warning about missing active vCPU.