Linux Kernel any version

ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea()

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 214616.

NVIDIA NemoClaw for Linux contains a vulnerability in its inference server setup, where a remote attacker may access the inference service without authentication. A successful exploit of this vulnerability may lead to information disclosure and denial of service.

ksmbd: add bounds check for durable handle context

ksmbd: fix out-of-bounds read in smb_check_perm_dacl()

WISA Smart Wing CMS File Download Vulnerability

IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user to impersonate another user on the system due to incorrectly updating the session identifier. IBM X-Force ID: 198191.

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A successful exploit of this vulnerability might lead to data tampering and denial of service.

mm, slub: do not call do_slab_free for kfence object

staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()

Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access

scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()

HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq

staging: rtl8723bs: fix OOB write in HT_caps_handler()

mm/slab: do not limit zeroing to orig_size when only red zoning is enabled

xfrm: Fix input error path memory access

net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels

wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()

staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop

staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop

HID: playstation: Clamp num_touch_reports

Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt

wifi: iwlwifi: mvm: don't read past the mfuart notifcation

Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components

Use after free in Chromoting in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: High)

IBM Guardium Data Protection is affected by multiple vulnerabilities.

Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req

wifi: mac80211: consume only present negotiated TTLM maps

Use after free in WebProtect in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Low)

ksmbd: fix type confusion via race condition when using ipc_msg_send_request

Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper input validation vulnerability. A remote low-privileged malicious user could potentially exploit this vulnerability to load any web plugins or Java class leading to the possibility of altering the behavior of certain apps/OS or Denial of Service.

Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc command modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.

Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.

Bluetooth: qca: fix info leak when fetching fw build id

Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

Insufficient validation of untrusted input in Downloads in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: High)

wifi: cfg80211: check A-MSDU format more carefully

Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: Low)

wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration

mac80211: validate extended element ID is present