Debian Debian Linux 10.0

vfio/fsl-mc: Block calling interrupt handler without trigger

net: stmmac: xgmac: fix handling of DPP safety error for DMA channels

iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC

net/rds: fix possible cp null dereference

net: mvpp2: clear BM pool before initialization

Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329).

scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload

clk: Get runtime PM before walking tree during disable_unused

net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()

pstore/zone: Add a null pointer check to the psz_kmsg_read

dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA

drm/lima: fix a memleak in lima_heap_alloc

riscv: Fix TASK_SIZE on 64-bit NOMMU

nouveau: fix instmem race condition around ptr stores

This issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, tvOS 16.4, watchOS 9.4. Processing maliciously crafted web content may bypass Same Origin Policy.

aufs: improperly managed inode reference counts in the vfsub_dentry_open() method

PCI/PM: Drain runtime-idle callbacks before driver removal

nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()

inet: read sk->sk_family once in inet_recv_error()

serial/pmac_zilog: Remove flawed mitigation for rx irq flood

ceph: fix deadlock or deadcode of misusing dget()

bpf, sockmap: Prevent lock inversion deadlock in map delete elem

soc: fsl: qbman: Always disable interrupts when taking cgr_lock

dm snapshot: fix lockup in dm_exception_table_exit

mptcp: fix possible deadlock in subflow diag

dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read

WordPress before 5.2.3 allows XSS in post previews by authenticated users.

WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer.

In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

Twisted vulnerable to NameVirtualHost Host header injection

XSS in Dijit Editor's LinkDialog plugin

In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user.

lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde Groupware Webmail Edition. This occurs after XSLT rendering.

In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls.

The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.

Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

Incorrect Transfer-Encoding handling with HTTP/1.0

Unexpected URL matching with 'MergeSlashes OFF'