CVE Vulnerability Catalog

In OpenDDS prior to 3.34.0, a network attacker can send a malformed RTPS UDP submessage that causes the read pointer to advance beyond valid data. This results in a SIGSEGV in the receive thread and termination of the DDS process. No authentication or user interaction is required.

In rabbitmq-c prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value, leading to a heap buffer overflow and memory corruption. This can cause denial of service and theoretically code execution.

MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme's statistics views. The event General card and the server/feed preview card constructed donut chart legend labels by directly concatenating object name or category keys into an innerHTML string without HTML-encoding. Because MISP object names are user-controllable by any authenticated user with sufficient permissions, an attacker could craft a name containing malicious markup. When any other user viewed the affected Overmind dashboard, the injected markup would be interpreted as live HTML/JavaScript in the victim's browser.

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker can set the person field to a reserved switch and the message field to a phar:// URI pointing to a malicious archive, leading to PHP code execution.

SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. An authenticated attacker can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses.

A flaw was found in the Linux kernel's batman-adv module in the batadv_bla_add_claim() function, which adds claims and modifies backbone CRC values. When the new-claim code path runs in parallel with the change-backbone code path, the backbone_gw pointer can be switched twice, producing an incorrect CRC. This wrong CRC is never recomputed from stored claims, causing persistent inconsistency.

In the Linux kernel, the dm-pcache module did not validate cache segment IDs from persistent memory before indexing into cache->segments[]. With only CRC protection using a public seed, an attacker with CAP_SYS_ADMIN supplying the cache device could cause out-of-bounds reads and writes via crafted metadata. The fix adds validation and rejects invalid segment IDs with -EIO.

A use-after-free vulnerability was found in the Linux kernel's virtio_pmem driver for NVDIMM persistent memory. The issue occurs when a request has already been freed by the submitter but is still reachable via the virtqueue, leading to waking up freed memory during interrupt handling.

In the Linux kernel, the drm/v3d driver does not clear queue->active_job when v3d_fence_create() fails. The run_job() callbacks for BIN, RENDER, TFU and CSD assign the job to queue->active_job before calling v3d_fence_create(); on failure they return NULL, leaving a dangling pointer. The fix adds a failure path clearing active_job.

In the Linux kernel, cros_typec_register_partner_pdos() copies partner PDOs from the EC TYPEC_STATUS response into the fixed caps_desc.pdo[PDO_MAX_OBJECTS] array (7 entries) without validating the count. If source_cap_count or sink_cap_count exceeds 7, memcpy writes past the stack array — a count of 255 overflows it by about 1 KB. The fix validates the counts and skips PDO registration when exceeded.

A use-after-free vulnerability exists in the Linux kernel HID subsystem. When a driver calls hid_device_io_start() and then fails during later initialization, unwinding via hid_hw_stop() can free the hidraw structure while in-flight HID reports are still being processed on another CPU, causing a dereference of freed memory. Eight drivers are affected because they do not call hid_device_io_stop() before hid_hw_stop().

In the Linux kernel, the drm/amdgpu/pm/powerplay module lacked bounds checks on vddInd and vddcInd indices from VBIOS-parsed tables. Invalid indices could cause out-of-bounds access to voltage lookup tables.

In the Linux kernel, the drm/amdgpu/pm/powerplay module lacked bounds checks on vddInd, vddciInd and mvddInd indices from VBIOS-parsed tables across nine sites. Invalid indices could cause out-of-bounds access to vddc, vddci and vddmem lookup tables.

In the Linux kernel, the drm/amd/display module's amdgpu_dm_plane_drm_plane_reset() freed the old state before allocating a new one. If kzalloc() failed, the state pointer was left dangling to freed memory.

In the Linux kernel, the drm/amd/display module's amdgpu_dm_crtc_reset_state() freed the old state before allocating a new one. If kzalloc() failed, the state pointer was left dangling to freed memory.

In the Linux kernel's dmaengine: xilinx_dma driver, a race condition existed in the AXIDMA and MCDMA interrupt handlers. The channel could be incorrectly marked idle and start spurious transfers while descriptors were still being processed, leading to descriptor corruption or missed completions.

In the Linux kernel, in the platform/chrome sensorhub module, max_response and sensor_num come from different EC commands. With malfunctioning EC firmware, the number of read bytes can be less than expected, causing an overread of the resp->fifo_info buffer in cros_ec_sensorhub_ring_handler(). The fix checks the return value of cros_ec_cmd_xfer_status() and aborts on length mismatch.

In the Linux kernel, the RDMA/irdma driver did not prevent userspace from deregistering the MRs backing QP/CQ/SRQ rings. The fix adds refcounting to user ring MRs by bumping the MR's refcount upon association.

A resource leak exists in the Linux kernel's nvmet-rdma module. When an NVMe target with RDMA transport is removed while I/Os are in flight, a response can be posted but its send completion is never delivered before the connection is torn down, so nvmet_rdma_send_done() and nvmet_rdma_release_rsp() are never called, leaking the allocated RDMA read/write context and request SGLs.

In the Linux kernel's BPF subsystem, there is a vulnerability allowing out-of-bounds memory access for MEM_ALLOC BTF pointers. During BTF struct walks, the size limit is not properly enforced for statically allocated objects, potentially leading to reads/writes beyond the allocated area.