CVE Vulnerability Catalog

When a crafted ed25519 private key containing an insane number of rounds is loaded, net-ssh enters an infinite CPU-time consuming loop for a very long time trying to load the key. The fact that the key is not a real SSH key does not matter in this regard.

In net-ssh, `Service::Forward#initialize` registers server-initiated auth-agent channel handlers unconditionally, so ordinary port forwarding exposes the local SSH agent.

net-ssh's host-certificate verifier (`Net::SSH::HostKeyEntries::CertAuthority#matches_key?`) checks exactly two things when a server presents an OpenSSH certificate (`*[email protected]`) under a `@cert-authority` trusted-CA entry: (1) the cert is self-consistently signed (signature_valid).

@tiptap/core's public mergeAttributes() helper uses ordinary bracket assignment on keys returned by Object.entries(). An own __proto__ key from JSON therefore invokes the legacy prototype setter on the fresh merged object, and the function returns an object whose prototype is attacker-controlled.

Nodemailer's SMTP client applies four regular expressions to a peer's EHLO response to detect supported SASL mechanisms. Each pattern uses overlapping whitespace-matching sub-patterns, producing quadratic (O(n^2)) backtracking on long mechanism names.

Shell command injection is possible in Net::SSH::Proxy::Command and Net::SSH::Proxy::Jump. When an application configures a proxy and passes attacker-influenced host, port, or remote_user values to Net::SSH.start (or a jump string to Proxy::Jump.new), shell metacharacters in those values may be interpreted.

Decode, DecodeChain, DecodeTrustStore, and ToPEM can incorrectly accept PKCS#12 files which were encoded with the wrong password, due to a failure to reject excessively-short PBMAC1 keys. Users who decode PKCS#12 files from untrusted sources and rely on the password for authentication can be affected.

Net::SSH::Transport::Session#poll_message pushes every packet received during key exchange that is not on the "allowed during KEX" list into an unbounded @queue (Array) with no size cap. A malicious server that completes KEXINIT (putting net-ssh into pending KEX) and then floods non-allowed packets can cause unbounded memory growth.

Nodemailer's address parser has three published, patched fixes for RFC 5322 comment handling inside an addr-spec. The description covers earlier issues with glued domain atoms and quoted local parts, plus related ReDoS fixes.

In the Linux kernel, a vulnerability related to the pstore: ram_core function has been fixed, which incorrectly returned a success pointer when the vmap() function failed.

A vulnerability has been identified in the Linux kernel related to ARM processor errors, occurring when the BIOS generates a very small or incomplete error. This can lead to improper memory dereferencing.

A vulnerability has been identified in the Linux kernel related to the failure to free memory in case of an error. Specifically, the screen buffer fbi->fb.screen_buffer is allocated using dma_alloc_coherent() but is not freed if an error occurs.

A vulnerability in the Linux kernel related to double free in the pruss_clk_mux_setup() function has been resolved. The issue occurred during the call to devm_add_action_or_reset(), which triggered pruss_of_free_clk_provider() on error.

The ifconfig command in Linux kernel 2.2 and later does not report when the network interface is in promiscuous mode if it was enabled using PACKET_MR_PROMISC. This could allow attackers to sniff network traffic undetected.

A vulnerability has been identified in the Linux kernel that has been resolved. The issue concerns the cper_print_fw_err() function, which does not check if the error record length is sufficient to handle the offset, potentially leading to malfunction in case of faulty firmware.

In the Linux kernel, a vulnerability related to a resource leak in the cx25821_dev_setup() function has been fixed. The issue occurred when ioremap() failed, leading to the memory region obtained by cx25821_get_resources() not being released.

A vulnerability in the Linux kernel related to validating rounded allocations in DRM_BUDDY_CONTIGUOUS_ALLOCATION has been resolved. The issue involved the requested size being rounded up to the next power of two, which could lead to errors.

A vulnerability has been identified in the Linux kernel related to a potential memory leak in the tw9903_probe() function. Memory allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() is not freed in one of the error paths.

A vulnerability has been identified in the Classmate laptop driver in the Linux kernel, related to missing NULL pointer checks. In several places, code using the accel object may run before the address of that object is stored in the input device driver data.

In the Linux kernel, a vulnerability related to dm-verity has been resolved, which incorrectly handled errors in the dm_bufio_client_create() function. If the call to this function fails, dm_bufio_client_destroy() is later called with an ERR_PTR() argument.