CVE Vulnerability Catalog

In the Linux kernel, in the DRM/XE driver (guc_submit), a race condition around the suspend_pending field was fixed, which could cause assertions and warnings in certain test scenarios.

In the Linux kernel's F2FS filesystem, there is potential corruption when moving a directory, similar to an issue in ext4. The fix addresses this problem.

In the Linux kernel's bcachefs filesystem, a missing bounds check in superblock validation could allow out-of-bounds read. The fix adds the missing check.

In the Linux kernel, a race condition was fixed in the OA TC6 network driver between reference pointers for TX packets. The issue involves managing two skb pointers for packets enqueued from the network stack.

In the Linux kernel's networking subsystem, a dangling sk pointer is left when socket creation fails, potentially leading to use-after-free when __sock_release() is called with an fentry probe.

W PHP 7.x przed 2017-03-07 występuje błąd w analizie wywołań fsockopen, który może prowadzić do nieprawidłowego interpretowania adresów i portów. Na przykład, wywołanie fsockopen('127.0.0.1:80', 443) może być zinterpretowane jako 127.0.0.1:80:443, co później jest skracane do 127.0.0.1:80.

A vulnerability in the Sanitize library allows bypassing CSS sanitization when <style> elements are allowed, when Sanitize::CSS#stylesheet or Sanitize::CSS#tree! is used to sanitize a stylesheet directly, or when output from Sanitize::CSS#properties is embedded inside a style rule. An attacker can inject malicious CSS, potentially leading to dangerous actions in the user's browser.