CVE Vulnerability Catalog

In the Linux kernel, the drm/panthor graphics driver added validation of firmware interface structure sizes. The iface_fw_to_cpu_addr() function only checked that the MCU virtual address points inside the shared section, but did not check that the entire structure fits, which could lead to out-of-bounds accesses.

In the Linux kernel, the amdgpu driver has a use-after-free vulnerability in amdgpu_dpm_get_pp_table(). The function returns a pointer to the power table after dropping the mutex, and a concurrent pp_table write can free the memory during the copy, leading to use-after-free. The fix copies data into caller-provided storage while holding the mutex.

In the Linux kernel, the amdgpu display driver has a divide-by-zero vulnerability in calculate_mcache_setting when the viewport has zero area. This causes a kernel panic and potential underflow on num_mcaches. The fix changes the function to return bool and adds guards to reject the mode when values are zero.

In the Linux kernel, the amdkfd driver has a uint32_t overflow vulnerability in EOP ring buffer size alignment. A user-supplied size of 0xFFFFF001 wraps to 0, bypassing the size check and allowing acceptance of any BO. This can lead to out-of-bounds writes and GPU faults.

In the Linux kernel, the amdkfd driver has a race condition in kfd_criu_checkpoint_events(). The counting and walking of events are not protected by event_mutex, which can lead to out-of-bounds writes or use-after-free. The fix holds the mutex during both operations.

In the Linux kernel, the vmwgfx driver has a vulnerability where the DRAW_PRIMITIVES header size is not validated before division. A small header size causes unsigned subtraction to wrap, leading to an out-of-bounds read. The fix rejects undersized headers.

In the Linux kernel, the vmwgfx driver has a vulnerability where the DMA command body size is not checked against the suffix pointer. This can cause the suffix pointer to underflow and overwrite verified fields of a previous command, enabling a TOCTOU attack. The fix rejects the command if the body is too small.

In the Linux kernel, the drm/xe driver's exec IOCTL did not wait on kernel fences for external BOs, potentially causing a race and memory corruption during moves. The fix adds kernel fence dependencies for all objects locked by the exec.

Apache Struts is vulnerable to uncontrolled resource consumption. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.

Apache Struts is vulnerable to uncontrolled resource consumption. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. Such endpoints are ordinarily reachable without authentication. Applications that do not collect violation reports are not affected.

The Templately plugin for WordPress (up to and including version 3.7.1) contains a Remote Code Execution (RCE) vulnerability in the fetch_remote_file function. The issue stems from a filename validation/destination mismatch — file type is validated against the Content-Disposition header, while the actual write path is derived from the URL, allowing a file with a .php extension to be written. An attacker with contributor-level access can bypass the unfiltered_upload capability gate and execute code on the server.

The Real Estate Manager Pro plugin for WordPress up to version 12.8.6 is vulnerable to privilege escalation. The allow_attachment_actions() function has improper capability handling, which can treat a target user ID as a media attachment ID during user capability checks. This allows authenticated attackers with Subscriber-level access and above to edit an administrator account and escalate their privileges to Administrator when the targeted user ID matches the ID of an existing media attachment.

The Wholesale Market plugin for WordPress up to version 2.2.2 is vulnerable to privilege escalation via the ced_wholesale_request_send AJAX action. The ced_wholesale_request_send_callback() handler only verifies a nonce (exposed to any authenticated user) and that the caller has a positive user ID, then calls WP_User::add_role() with the client-supplied role_required POST parameter without restricting the value to an allowlist of wholesale roles. This allows authenticated attackers with Subscriber-level access and above to elevate their privileges to Administrator when the site administrator has enabled the 'Assigning requested role directly' option.

In the Linux kernel's sun4i-ss driver, the insecure and unused RNG algorithm (sun4i_ss_rng) was removed. It had multiple vulnerabilities including missing locking, buffer overflow, and improper random byte generation. Since no users are known, the code was removed instead of fixed.

In the Linux kernel's rxrpc subsystem, rxrpc_verify_data does not always allocate the rx_dec_buffer, which can lead to a call to skb_copy_bits with a NULL destination and a NULL pointer dereference. The fix ensures allocation is always attempted when the buffer is NULL.

In the Linux kernel's rxrpc subsystem, rxrpc_recvmsg() may enter an infinite loop because the wait does not check the OOB queue. The fix adds a check for the OOB queue in the wait loop.

A vulnerability was found in the Linux kernel's rxrpc subsystem, involving improper handling of ACKALL packets. A forged ACKALL packet can be accepted for a new server call in an invalid state, leading to a NULL pointer dereference and system crash.

In the Linux kernel, the rxrpc subsystem fixed an issue with receiving a reply packet before data transmission. The function rxrpc_receiving_reply() did not check if the call had been exposed, which could lead to an oops in rxrpc_rotate_tx_window(). Additionally, the do...while loop was changed to a while loop to handle an empty transmission queue.

In the Linux kernel, the AFS subsystem fixed handling of CB.InitCallBackState3 requests without a server record. It checks whether a server record was attached, and if not, the request is ignored, matching existing behavior for other unmatched callback requests.

In the Linux kernel, the accel/amdxdna driver did not limit the amount of data returned to user space by the buffer size provided by the application. If the buffer was smaller than the data size, it returned an error instead of only the fitting portion.