Debian Debian Linux 11.0

FastDDS's heap buffer overflow in RTPS DATA_FRAG enables unauthenticated DoS (potential RCE)

bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT

scsi: lpfc: Fix buffer free/clear order in deferred receive path

scsi: target: iscsi: Fix timeout on deleted connection

ksmbd: fix Preauh_HashValue race condition

ipv6: sr: Fix MAC comparison to be constant-time

smb: client: fix use-after-free in cifs_oplock_break

tls: always refresh the queue when reading sock

netfilter: nf_conntrack: fix crash due to removal of uninitialised entry

nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()

RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction

drbd: add missing kref_get in handle_write_conflicts

net, hsr: reject HSR frame if skb can't hold tag

PgBouncer default auth_query does not take Postgres password expiry into account

rpl: Fix use-after-free in rpl_do_srh_inline().

tls: separate no-async decryption request handling from async

libceph: fix invalid accesses to ceph_connection_v1_info

ppp: fix race conditions in ppp_fill_forward_path

Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Cross-site Scripting (XSS) - DOM in ledgersmb/ledgersmb

Cross-site Scripting (XSS) - Reflected in ledgersmb/ledgersmb

Heap buffer overflow in Skia in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Heap buffer overflow in fingerprint recognition in Google Chrome on ChromeOS prior to 96.0.4664.45 allowed a remote attacker who had compromised a WebUI renderer process to potentially perform a sandbox escape via a crafted HTML page.

Use after free in Web Transport in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

Heap buffer overflow in Crashpad in Google Chrome on Android prior to 107.0.5304.106 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

cifs: Fix buffer overflow when parsing NFS reparse points

netfilter: nf_set_pipapo_avx2: fix initial map fill

net: openvswitch: Fix the dead loop of MPLS parse

bpf: Scrub packet on bpf_redirect_peer

mptcp: plug races between subflow fail and subflow creation

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.

A type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.

There is an integer overflow vulnerability in dcraw. When the victim runs dcraw with a maliciously crafted X3F input image, arbitrary code may be executed in the victim's system.

Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails

Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code

x86/sev: Evict cache lines during SNP memory validation