CVE Vulnerability Catalog

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding on the output filename after URL parsing, allowing an attacker to embed %2e%2e%2f sequences that survive parsing but decode into directory traversal sequences, enabling writes to arbitrary filesystem paths.

The Joomla extension iCagenda (icagenda.com) contains a stored XSS vulnerability via a URL-type custom field in events. This affects versions 3.2.1 to 4.0.16.

In the Linux kernel, the Hyper-V (hv) driver incorrectly forces the VMBus connection state to DISCONNECTED before calling vmbus_disconnect(). As a result, vmbus_initiate_unload() does not unload the connection because it only acts when the state is CONNECTED, so the Hyper-V host may continue sending messages or posting VMBus interrupts.

In the Linux kernel vsock subsystem, the TCP_ESTABLISHED to TCP_CLOSING transition on OP_RST can race with the connect loop. Resetting a socket still present in connected_table can lead to memory corruption, including a double list add and a kernel BUG.

In the Linux kernel net/rds module, rds_rdma_cm_event_handler_cmn() returns the result of rdma_resolve_route() directly to rdma_cm on RDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure causes the id ic->i_cm_id to be destroyed while RDS still owns it, leading to use of a freed id during connection shutdown.

In the Linux kernel, pipe fasync handling has a bug in fasync_helper() when two enables of one O_RDWR FIFO race. The error path removes a pre-existing reader entry, leading to a use-after-free in send_sigio() triggerable by an unprivileged user under memory pressure.

In the Linux kernel firewire subsystem, a race condition exists in split transaction handling. Both the response handler and the timeout callback may process the same transaction entry, leading to a use-after-free on the transaction initiator side.

A use-after-free flaw in the Linux kernel Unicode handling was fixed. generic_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and dereference the Unicode map during RCU pathwalk, while ext4, f2fs and tmpfs drop the map via utf8_unload() in ->put_super() when the last mount reference goes away. A lookup still inside such a filesystem can then read freed memory.

In the Linux kernel KVM SEV module, sev_gmem_post_populate() calls set_page_dirty() without holding the required lock, which can race with the page's mapping going away. The fix replaces the call with set_page_dirty_lock().

A use-after-free vulnerability exists in the Linux kernel's eventfs mechanism. tracefs_d_revalidate() reads the ->is_freed field of an eventfs_inode during RCU pathwalk with only rcu_read_lock() held, while the object is freed after an SRCU grace period that does not wait for rcu_read_lock() sections. As a result, a walker can read already freed memory.

The Linux kernel has a namespace mount handling flaw: copy_tree() omits mounts of mount namespace files (e.g. /proc/<pid>/ns/mnt) without checking MNT_LOCKED. This lets a task that is root in its own user namespace bypass a locked cover mount and expose a hidden file without a race and without touching the underlying filesystem. The fix makes such copying fail with EPERM and refuses to move a mount namespace file mount beneath a locked mount.

In the Linux kernel, __tcf_action_put() (net/sched) has a use-after-free: the reference count is decremented before the binding count, so another thread can free the action between these operations, causing the binding-count update to access freed memory.

In the Linux kernel, the SPI imx driver allocates DMA bounce buffers that are too small (kzalloc(dma_len) instead of DMA_CACHE_ALIGNED_LEN(dma_len)), while the DMA API operates on memory beyond the allocation end. This causes slab corruption, leading to refcount_t warnings and kernel oops. The issue is fixed by allocating and syncing buffers with the correct aligned length.

In the Linux kernel, check_synth_field() incorrectly validated synthetic trace event fields of stacktrace type. An 8-byte signed scalar field could pass validation and then be dereferenced as a kernel stacktrace pointer, causing an invalid memory access.

In the Linux kernel, the scsi: st driver has a use-after-free race between st_remove() and st_open(). st_remove() removes the idr entry only after dropping the reference, so a concurrent st_open() can find the freed structure and call kref_get() on it.

In the Linux kernel, libiscsi's __iscsi_complete_pdu() resolves a task from the ITT index in management responses (Logout, Login, Text, TMFunc, NOP-In) and only validates that the index is in bounds. A malicious or faulty target can name an unused pool slot where task->conn is NULL, causing a NULL pointer dereference and kernel oops after a single unsolicited NOP-In or Text Response.

In the Linux kernel's drm/amdgpu driver, amdgpu_gem_object_close() detaches the user queue eviction fence from the BO before checking bo_va->ref_count. Closing any handle of a BO removes the fence even when the file still has another handle and GPU mappings, allowing the BO to be evicted without suspending the user queues.

In the Linux kernel's tracing module, predicate_parse() adds two to nr_preds to reserve terminal TRUE and FALSE entries and uses that increased value as the limit for parsed predicates. If the initial count is smaller than the number actually parsed, the program can fill the allocation and subsequent accesses can go past its end.

In the Linux kernel's tracing module, predicate_parse() uses the first operator stack entry before processing any opening parentheses. A push increments top before writing, and the existing check still permits the write when top already points to the last allocated entry, potentially accessing beyond the operator stack.

In the Linux kernel dm-crypt, crypt_dec_pending reads io->error before atomic_dec_and_test, creating a race condition. As a result, a failed read or write may be incorrectly reported as successful.