Linux Kernel any version

An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.18 before 5.18.18. fs/ksmbd/smb2pdu.c lacks length validation in the non-padding case in smb2_write.

A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash. *Note: This issue only affected Linux operating systems. Other operating systems are unaffected.* This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.

Use-after-free in parse_lease_state()

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to overwrite arbirary files due to improper group permissions. IBM X-Force ID: 191945.

smb: client: fix potential OOBs in smb2_parse_contexts()

IBM CloudPak for Multicloud Monitoring 2.0 and 2.3 has a few containers running in privileged mode which is vulnerable to host information leakage or destruction if unauthorized access to these containers could execute arbitrary commands. IBM X-Force ID: 211048.

MaxBoard XSS and File Upload Vulnerability

NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an attacker could cause a system failure. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979.

net/tls: Fix use-after-free after the TLS device goes down and up

firmware: arm_scmi: Harden accesses to the reset domains

afs: Increase buffer size in afs_update_volume_status()

ipv6: fix possible UAF in ip6_finish_output2()

ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()

CVE

btrfs: fix qgroup reserve overflow the qgroup limit

ksmbd: add a permission check for FSCTL_SET_ZERO_DATA

rdma/cxgb4: Prevent potential integer overflow on 32bit

net: amd-xgbe: Fix skb data length underflow

enetc: Fix illegal access when reading affinity_hint

arp: use RCU protection in arp_xmit()

nvmet-auth: assign dh_key to NULL after kfree_sensitive

ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read

ipv6: use RCU protection in ip6_default_advmss()

IBM InfoSphere Information Server privilege escalation

ksmbd: fix out-of-bound read in smb2_write

mptcp: pm: Fix uaf in __timer_delete_sync

btrfs: fix abort logic in btrfs_replace_file_extents

x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines

Path Traversal Vulnerability in File Component Leading to Arbitrary File Read and Authentication Bypass

smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path

SUNRPC: Fix UAF in svc_tcp_listen_data_ready()

rxrpc: Fix error handling in rxgk_extract_token()

smb: client: fix OOB reads parsing symlink error response

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow an authenticated user to obtain highly sensitive information or perform unauthorized actions due to improper input validation. IBM X-Force ID: 233777.

ipv4: use RCU protection in __ip_rt_update_pmtu()

smb/client: fix possible infinite loop and oob read in symlink_data()

crypto: qcom-rng - ensure buffer for generate is completely filled

IBM OpenPages with Watson information disclosure

ksmbd: add bounds check for create lease context