Linux Kernel

wifi: mac80211: don't return unset power in ieee80211_get_tx_power()

bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself

wifi: iwlwifi: dbg-tlv: ensure NUL termination

An issue was discovered in the Linux kernel before 6.3.9. ksmbd does not validate the SMB request protocol ID, leading to an out-of-bounds read.

An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/connection.c in ksmbd does not validate the relationship between the NetBIOS header's length field and the SMB header sizes, via pdu_size in ksmbd_conn_handler_loop, leading to an out-of-bounds read.

Path Traversal in parisneo/lollms-webui

An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, accepts an arbitrary SSL certificate.

In kernel/compat.c in the Linux kernel before 3.17, as used in Google Chrome OS and other products, there is a possible out-of-bounds read. restart_syscall uses uninitialized data when restarting compat_sys_nanosleep. NOTE: this is disputed because the code path is unreachable

Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)

"IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 236584."

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

drm/amd/display: Avoid HDCP over-read and corruption

Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979.

IBM Security Guardium Key Lifecycle Manager directory traversal

USB: core: Fix access violation during port device removal

tipc: Return non-zero value from tipc_udp_addr2str() on error

cifs: potential buffer overflow in handling symlinks

Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.

bridge: br_nd_send: linearize skb before parsing ND options

netfilter: nfnetlink_osf: fix out-of-bounds read on option matching

OS command injection in IBM Aspera Faspex

browser/extensions/api/dial/dial_registry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0.2840.100 on Linux neglects to copy a device ID before an erase() call, which causes the erase operation to access data that that erase operation will destroy.

smack: tcp: ipv4, fix incorrect labeling

A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems allows application administrators to execute malicious commands on the host device being restored.

netlabel: fix out-of-bounds memory accesses

nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

sctp: validate embedded INIT chunk and address list lengths in cookie

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure.

btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()

ocfs2/dlm: validate qr_numregions in dlm_match_regions()

RDMA/srp: bound SRP_RSP sense copy by the received length

dcache: Limit the minimal number of bucket to two

libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()

sctp: fix uninit-value in __sctp_rcv_asconf_lookup()

libceph: Fix potential out-of-bounds access in osdmap_decode()

drm/sched: Avoid data corruptions

libceph: prevent potential out-of-bounds reads in process_message_header()

libceph: Fix slab-out-of-bounds access in auth message processing

RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg

inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP