Linux Kernel

Improper Use of Validation Framework

Use of Password Hash with Insufficient Computational Effort

Missing Cryptographic Step

svcrdma: bound check rq_pages index in inline path

Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()

Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)

RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation

rpl: Fix use-after-free in rpl_do_srh_inline().

nvme-tcp: remove tag set when second admin queue config fails

netfs: Fix double put of request

ksmbd: fix use-after-free of share_conf in compound request

Race in Media in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to corrupt media stream metadata via a crafted HTML page. (Chromium security severity: Low)

tls: separate no-async decryption request handling from async

RustDesk Auth Proof Uses Server-Controlled Salt/Challenge and Fast Double-SHA256, Enabling Offline Brute-Force

libceph: fix invalid accesses to ceph_connection_v1_info

Spectrum session token in URL

xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()

Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

Revert "xsk: Support redirect to any socket bound to the same umem"

ppp: fix race conditions in ppp_fill_forward_path

net: libwx: remove duplicate page_pool_put_full_page()

bnxt: properly flush XDP redirect lists

net: libwx: fix the using of Rx buffer DMA

tipc: do not update mtu if msg_max is too small in mtu negotiation

nvme-tcp: sanitize request list handling

ice: fix Rx page leak on multi-buffer frames

ksmbd: fix use-after-free in durable v2 replay of active file handles

net/smc: Reset connection when trying to use SMCRv2 fails.

smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)

.NET Security Feature Bypass Vulnerability

scsi: target: iscsi: Fix a race condition between login_work and the login thread

Insufficient policy enforcement in Network in Google Chrome prior to 144.0.7559.59 allowed an attack who obtained a network log file to potentially obtain potentially sensitive information via a network log file. (Chromium security severity: Medium)

btrfs: fix use-after-free warning in btrfs_get_or_create_delayed_node()

s390/ism: fix concurrency management in ism_cmd()

Use after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to Array.prototype.indexOf.

Typora DOM-Based Cross-site Scripting leading to Remote Code Execution

A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability, one must open a file in Typora. The XSS vulnerability is then triggered due to improper HTML sanitization. Given that the application is based on the Electron framework, the XSS leads to remote code execution in an unsandboxed environment.

Maxboard Remote Code Execution