| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| In removeUserData of DevicePolicyManagerService.java, there is a possible denial of service due to a race condition. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. |
| In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. |
| In the Linux kernel, the following vulnerability has been resolved:
tipc: protect node reset trace dump with node lock
The tipc_node_reset_links trace event asks tipc_node_dump() to walk the
node's link entries. Unlike the other node events that request link data,
this event runs without the node lock.
This permits bearer teardown to free a link while the trace callback is
dumping it:
CPU 0 CPU 1
trace_tipc_node_reset_links()
tipc_node_dump()
l = n->links[0].link
tipc_node_write_lock()
kfree(l)
n->links[0].link = NULL
tipc_node_write_unlock()
tipc_link_dump(l)
tipc_link_dump() then dereferences the stale pointer. KASAN reported:
BUG: KASAN: slab-use-after-free in tipc_link_dump
Read of size 4 by task poc/115
Call Trace:
tipc_link_dump+0x10cb/0x16b0
tipc_node_dump+0x4bb/0x740
trace_event_raw_event_tipc_node_class+0x258/0x360
tipc_node_reset_links+0x14d/0x1a0
tipc_rcv+0x13f5/0x3030
tipc_udp_recv+0x4e3/0x670
Allocated by task 0:
tipc_link_create+0x1e1/0x1020
tipc_node_check_dest+0x7d2/0x11a0
tipc_disc_rcv+0xdbf/0x1430
Freed by task 89:
kfree+0x131/0x3c0
tipc_node_link_down+0x267/0x4b0
tipc_node_delete_links+0xec/0x160
bearer_disable+0x107/0x260
Take the node write lock around the trace event. This serializes the
dump against tipc_node_link_down(delete=true), which frees the link
under the same write lock. |
| Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| Use after free in WebAudio in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intended buffer or potentially cause a denial-of-service (DoS) via a crafted packet.
Refer to the '
Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information. |
| A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing replay of previously consumed assertion IDs within their validity period. |
| The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment. |
| The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute filesystem paths to unauthenticated users. |
| In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, evicting the last attribute in an MRP participant's list writes through a null successor pointer. An unauthenticated station on the same Layer 2 segment can fault the MRP worker thread by declaring one MSRP attribute and withdrawing it, and ordinary withdrawals by legitimate stations reach the same path. |
| In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP attribute lookup writes through the null pointer returned by its allocator when the ten-entry attribute table is full. An unauthenticated station on the same Layer 2 segment can fault the MRP worker thread by declaring enough new attributes, and Talker Failed declarations hold table entries that are never released. |
| Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.
A user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB which can cause the broker to shutdown and be unrecoverable.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue. |
| In the Linux kernel, the following vulnerability has been resolved:
io_uring/net: don't retry recv on uncommitted buffers
Commit 41b70df5b38b ("io_uring/net: commit partial buffers on retry")
commits ring provided buffers when a receive is going to be retried after
a partial transfer, so that another request using the same buffer group
can't be handed the memory the first one keeps receiving into. It commits
the number of bytes received so far. That does the job for a single
buffer which is consumed as a whole, but the request hangs on to all it
has mapped:
- For a buffer ring with IOU_PBUF_RING_INC only these bytes are consumed.
The rest of the buffer stays at the head of the ring.
- For a bundle only the buffers which hold these bytes are consumed, the
others that were peeked stay in the ring.
In both cases the next receive with that buffer group gets memory that
the retried request is still going to write to, and whoever comes last
overwrites the data of the other. What the retry fills isn't committed at
all, as the buffer list isn't known any more at that point. So the kernel
hands it out again later on, while the CQE tells the application that it
was used, and for an incremental buffer that it is done with.
The remainder can't be committed in advance: if the request ends up
receiving less, there is no way to tell the application that more was
consumed than the CQE accounts for. Complete the request with what it has
got instead of retrying it. MSG_WAITALL is no longer honoured for
receives into incremental buffers or multi buffer bundles, they can
return a short count, with the request marked as failed like for other
short MSG_WAITALL transfers. |
| Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
