Linux Kernel any version

smb: client: fix krb5 mount with username option

Bluetooth: l2cap: Check encryption key size on incoming connection

The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space.

The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with root privileges.

An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could potentially use this flaw to crash the system or escalate privileges on the system.

A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.

.NET, Visual Studio, and Build Tools for Visual Studio Spoofing Vulnerability

Linux Kernel libbpf btf_dump.c btf_dump_name_dups use after free

Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout

Protecting AWS credentials stored in plaintext on My Cloud Home

IBM Aspera Console CSV injection

Adobe Experience Manager Forms JEE | Cross-site Scripting (Reflected XSS) (CWE-79)

Bluetooth: fix UAF in bt_accept_dequeue()

Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()

wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes

IBM HTTP Server is affected by multiple vulnerabilities

Bluetooth: SCO: Fix UAF on sco_sock_timeout

greybus: gb-beagleplay: bound bootloader receive buffering

Bluetooth: ISO: Fix UAF on iso_sock_timeout

ieee802154/adf7242: defer destroy_workqueue call

Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()

Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api modules) allows Interface Manipulation (data access to the production database cluster).This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.

Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()

xhci: tegra: fix checked USB2 port number

ASoC: Intel: soc-acpi-intel-mtl-match: add missing empty item

Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

Heap-based buffer overflow in the iscsi_add_notunderstood_response function in drivers/target/iscsi/iscsi_target_parameters.c in the iSCSI target subsystem in the Linux kernel through 3.9.4 allows remote attackers to cause a denial of service (memory corruption and OOPS) or possibly execute arbitrary code via a long key that is not properly handled during construction of an error-response packet.

Use after free in SNDRV_CTL_IOCTL_ELEM in Linux Kernel

The igb_receive_skb function in drivers/net/igb/igb_main.c in the Intel Gigabit Ethernet (aka igb) subsystem in the Linux kernel before 2.6.34, when Single Root I/O Virtualization (SR-IOV) and promiscuous mode are enabled but no VLANs are registered, allows remote attackers to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact via a VLAN tagged frame.

A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

KVM: arm64: Fix shift-out-of-bounds bug

KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()

KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation

KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1

Integer overflow in TCP_SKB_CB(skb)->tcp_gso_segs

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.

Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service

Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.