CVE Vulnerability Catalog

phpMyFAQ before 4.1.6 has a vulnerability in the StopWords::add() method that builds a SQL INSERT statement using sprintf() and inserts the user-supplied stop word value directly into the query without calling the database escaping function. An authenticated administrator can submit a crafted value that breaks out of the SQL string literal and injects arbitrary SQL, including dropping tables, exfiltrating data, or modifying other rows.

MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges.

Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence the owner value may take over or prematurely expire a lock held by another process, leading to duplicated or conflicting operations.

A flaw in the Linux kernel's ksmbd module related to DACL permission checks has been fixed. The access control logic did not consider an Authenticated Users ACE (S-1-5-11), causing files accessible to authenticated users to incorrectly fail with STATUS_ACCESS_DENIED. Additionally, maximal access calculation combined access masks from all ACEs regardless of whether their SID applied to the current user, potentially granting rights belonging to unrelated principals.

In the Linux kernel, gb_audio_gb_get_topology() fetches a topology blob of a module-supplied size, and gbaudio_tplg_parse_data() uses the size_dais, size_controls and size_widgets fields to compute section offsets without validating them against the fetched size. A module reporting a small topology size but large section sizes makes offsets point past the allocation, causing out-of-bounds reads.

In the Linux kernel, the RDMA/bnxt_re driver's destroy callbacks zero the udata output after tearing down driver resources. If the userspace access fails, uverbs preserves the uobject and allows the destroy callback to run again even though the driver resource has already been freed. The fix moves ib_no_udata_io() before teardown and ib_respond_empty_udata() to the start of create and modify flows.

In the Linux kernel, the PCI/pwrctrl tc9563 driver parsing both functions of the integrated Ethernet MAC Endpoint under DSP3 caused an out-of-bounds access past the tc9563_pwrctrl->cfg array. The fix parses the Endpoint node under DSP3 instead of both functions.

In the Linux kernel, in the md/raid5-ppl module, the ppl_do_flush() function continues iterating after calling ppl_io_unit_finished(), which frees the io object. Subsequent access to io->pending_flushes leads to a use-after-free.

In the Linux kernel for powerpc architecture in the XIVE subsystem, when xive_init_ipis() fails, the global xive_ipis array is freed. However, xive_smp_probe() previously ignored this failure and called xive_setup_cpu_ipi(), which dereferenced the already-freed pointer, leading to a use-after-free.

A use-after-free vulnerability has been found in the Linux kernel's vxlan_mdb_flush() function used for VXLAN multicast database (MDB) management. The flaw allows freeing one MDB entry while iterating over another, leading to a write to freed memory during deletion operations.

The Linux kernel for the LoongArch architecture lacks a DIRECT_MAP_PHYSMEM_END definition, causing get_free_mem_region() and mhp_get_pluggable_range() to potentially return ZONE_DEVICE regions outside the vmemmap window. This can lead to page table corruption or system crashes, especially on CPUs with fewer physical address bits, such as the Loongson-2K series.

In the NFS server (nfsd), there is a missing read barrier in the rpc_status_get dumpit function, which on weakly-ordered architectures (ARM, POWER) can lead to an ineffective retry mechanism. This could result in reading inconsistent data. The fix adds smp_rmb() before the second counter check.

In the phy driver (fsl-imx8mq-usb), there is a leak of the typec switch when probe errors occur. The fix uses devm_add_action_or_reset() to ensure cleanup on both probe failure and driver removal.

A flaw was fixed in the Linux kernel's svcrdma module where a failed accept path called rpcrdma_rn_unregister() without a prior successful registration. This caused erasure of another caller's XArray slot and an unmatched reference release on the RDMA device, as well as a memory leak of the svcxprt_rdma structure on every failed accept.

A race condition exists in the Linux kernel's nfsd_net structure, where the boolean field grace_ended is read and written without synchronization from multiple threads. Two concurrent calls to nfsd4_end_grace() can both proceed to nfsd4_record_grace_done(), leading to a double-free and corruption of the reclaim_str_hashtbl list. The vulnerability is fixed by replacing boolean fields with a flags word and using the atomic test_and_set_bit() operation.

zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump().

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() function. A specially crafted SVG document containing sufficiently large geometry coordinates can cause fixed-point-scaled edge coordinates to exceed the range representable by int.

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__pathArcTo() when parsing SVG arc commands. A specially crafted SVG document containing extreme arc radius values can cause intermediate arc calculations to produce a NaN delta angle.

MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation.

SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec() when parsing PDF PageLabels /Nums entries.