CVE Vulnerability Catalog

In the Linux kernel, the staging rtl8723bs driver's rtw_sdio_if1_init() function frees padapter->HalData with kfree(), even though it was allocated via vzalloc(). Using kfree() to release a vmalloc-backed buffer can lead to memory corruption.

A vulnerability has been found in GibbonEdu Gibbon up to version 30.0.01. The affected element is the makeBlock function in modules/Planner/units_add_blockAjax.php of the Unit Planner component. Manipulation of gibbonUnitBlockID/mode leads to missing authentication. The attack can be carried out remotely. The exploit has been disclosed. Upgrading to version 31.0.00 fixes the issue.

A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML parser can dereference a freed sheet-object component, causing Gnumeric to crash.

In kitty versions from 0.40.0 to 0.49.0, there is an out-of-bounds write vulnerability in the natural width branch of the text sizing protocol. A program writing to the terminal can send an OSC 66 escape code with a grapheme cluster longer than four codepoints, causing a write past the end of the fixed-size buffer in screen_handle_multicell_command(). This results in termination of the kitty process and all its windows, tabs and child processes.

In kitty versions 0.47.0 to 0.49.0, there is an improper link resolution before file access in the drag source staging path of the drag and drop protocol. A program writing to the terminal can create files and directories outside the staging directory by crafting entries with symlinks and subsequently following them during item creation. This allows the attacker to write to any path writable by the user running kitty.

The AIL Framework crawler splash domain page (showDomain.html) is vulnerable to stored cross-site script injection (XSS). User-supplied data from imported crawler captures (item IDs, URLs, and screenshot file paths) is interpolated directly into inline JavaScript contexts without escaping. An attacker with a user-role API client can import a malicious capture, and when any user (including privileged ones) views the domain page, the script executes in the victim's browser.

The Onion module in AIL Framework has a performance shortcut in URL extraction that accepts URLs as valid .onion targets based only on a length check (exactly 69 characters) and a suffix check (ending in '.onion'), without proper hostname parsing. An unauthenticated attacker who can publish or control web content crawled by the framework can embed a crafted URL with an IP address or non-onion hostname that satisfies these conditions and gets queued as a legitimate onion crawler task.

The AIL Framework crawler task creation API (api_add_crawler_task) has an insufficient authorization check when a user supplies a cookiejar UUID. The original code only verified that the cookiejar exists and, if its access level was 0, compared the owner user ID to the requesting user ID. It did not validate organizational boundaries or account for the user's role. An authenticated user can reference another organization's cookiejar and have the crawler use that organization's stored cookies when performing web crawls.

The AIL Framework tag selector component (var/www/static/js/tags.js) is vulnerable to stored XSS. A user with the ability to create custom tags can embed HTML payloads containing JavaScript event handlers in the tag name. When another authenticated user opens a page containing the tag selector, the malicious tag name is inserted into the DOM using jQuery's html property, causing the embedded script to execute.

In the Linux kernel, the USB Type-C (ucsi) subsystem's ucsi_register() creates per-instance debugfs entries, but ucsi_unregister() keeps them until ucsi_destroy(). Drivers like ucsi_glink that unregister/register the same UCSI instance across remoteproc restart then try to create an already existing debugfs directory.

In the Linux kernel, the iwlwifi (mei) driver's iwl_mei_write_cyclic_buf() function receives an incorrect first argument — the q_head pointer is passed instead of cldev. The bug has been fixed.

In the Linux kernel, the drm/msm driver does not safely retire a hung submit before GPU recovery completes. Retiring the submit triggers BO free, which can result in GPU pagefaults since the GPU may be actively accessing those BOs.

In the Linux kernel, the staging rtl8723bs driver has a memory leak on error paths in issue_beacon(), issue_probersp(), and issue_asocrsp(). When an error occurs after a successful alloc_mgtxmitframe() but before dump_mgntframe(), the management xmit_frame and xmit_buf are neither freed nor placed on any list. Repeated occurrences progressively exhaust the management-TX pools until the interface can no longer send beacons or probe/assoc responses.

In the Linux kernel, a bug was fixed where the BPF_REFCOUNT field was not marked as unique, although it should be. The fix addresses this oversight.

In the Linux kernel, a bug in the netfilter nf_nat_sip module was fixed where the offset was not rewound when NAT shrinks the packet. If map_addr() changes the packet length, coff may point to an incorrect position, potentially causing subsequent Contact headers to be skipped and leaking internal network details.

A reflected cross-site scripting (XSS) vulnerability exists in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0. An authenticated attacker with Wagtail Editor privileges can execute arbitrary code in the victim's browser via a crafted payload.

Netgate pfSense version 26.03.1-RELEASE is vulnerable to Cross Site Scripting (XSS), allowing an attacker to execute arbitrary code in the victim's browser context through the pfBlockerNG package.

A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multiple_locations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted HTTP PATCH request.

In the Linux kernel, the wifi mt76 (mt7921) driver lacks validation of CLC firmware records. The loader trusts the region count and each record length, so a malformed image can make the region table pointer precede the firmware buffer, make the record loop fail to advance, or index phy->clc past its end.

In the Linux kernel, a vulnerability in ppp_async causes the error path to zero the skb headroom, violating the NET_SKB_PAD guarantee. As a result, a subsequent frame can be processed without the required headroom, leading to a kernel panic (skb_under_panic) or an out-of-bounds read when CCP compression is enabled.