OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf31::LineCompositeTask::execute (called from IlmThread31::NullThreadPoolProvider::addTask and IlmThread31::ThreadPool::addGlobalTask). NOTE: db217f2 may be inapplicable.
Cap'n Proto is a data interchange format and remote procedure call (RPC) system. Cap'n Proro prior to versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3, as well as versions of Cap'n Proto's Rust implementation prior to 0.13.7, 0.14.11, and 0.15.2 are vulnerable to out-of-bounds read due to logic error handling list-of-list. This issue may lead someone to remotely segfault a peer by sending it a malicious message, if the victim performs certain actions on a list-of-pointer type. Exfiltration of memory is possible if the victim performs additional certain actions on a list-of-pointer type. To be vulnerable, an application must perform a specific sequence of actions, described in the GitHub Security Advisory. The bug is present in inlined code, therefore the fix will require rebuilding dependent applications. Cap'n Proto has C++ fixes available in versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3. The capnp Rust crate has fixes available in versions 0.13.7, 0.14.11, and 0.15.2.
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags " command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input.
[Suggested description] An issue was discovered in the FFmpeg through 3.0. vp3decodeframe in libavcodec/vp3.c lacks check of the return value of avmalloc() and will cause the null pointer dereference.
------------------------------------------
[VulnerabilityType Other] NULL Pointer Dereference
------------------------------------------
[Vendor of Product] the development group
------------------------------------------
[Affected Product Code Base] FFmpeg - 3.0
------------------------------------------
[Reference] https://github.com/FFmpeg/FFmpeg/commit/656cb0450aeb73b25d7d26980af342b37ac4c568
------------------------------------------
[Discoverer] Jiasheng Jiang
Last updated 25 April 2025
A double-free flaw was found in the Linux kernel in the emsusbstartxmit function. This flaw allows an attacker to create a memory leak and corrupt the underlying data structure by calling free more than once.
A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and potentially execute code.
A use-after-free flaw was found in the Expat package, caused by destruction of a shared DTD in XMLExternalEntityParserCreate in out-of-memory situations. This may lead to availability disruptions.
A buffer overflow flaw was found in the u8 overflow in cfg80211updatenotlistednontrans() in net/wireless/scan.c in the Linux kernel’s wifi subcomponent. This flaw allows an attacker to crash the system or leak internal kernel information.
A use-after-free flaw was found in bssrefget in the net/wireless/scan.c in the Linux kernel. This issue can lead to a denial of service or arbitrary code execution.
A list corruption flaw was found in cfg80211addnontranslist in the net/wireless/scan.c function in the Linux kernel. This flaw could lead to a denial of service.
Chromium: CVE-2023-2136 Integer overflow in Skia
In appendtoverifyfifointerleaved of streamencoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNTSizeRequest.
An issue found in linux-kernel that leads to a race condition in roseconnect(). The rose driver uses roseneigh->use to represent how many objects are using the roseneigh. When a user wants to delete a roseroute via roseioctl(), the rose driver calls rosedelnode() and removes neighbours only if their “count” and “use” are zero.
drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel memory because stexqueuecommandlck lacks a memset for the PASSTHRUCMD case.
A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in libcstartmain (/lib/x8664-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING
A flaw use after free in the Linux Kernel found in the Amateur Radio X.25 Packet Layer Protocol (PLP Rose).
The bug is race condition inside rosebind() function. The rosebind() binds an sk and a given address, and then adds the sk to roselist via roseinsertsocket(). Since there is no locksock() in rosebind(), a user can call rosebind() from two threads at the same moment, and the victim sk is possible to be added to roselist twice.
If the race is succeed, sk->sknode.next will point to sk itself, which makes it become a cycle, and the sk's refcount is one more than the normal case. When releasing the sk, according to rosedestroysocket(), roseremovesocket() is called multiple times which is up to skhasallocations(). If skhasallocations() returns false the first time, sk won't be freed and cause a memory leak. Otherwise, sk is freed but can still be accessed via roselist, which causes a use-after-free. An attacker is able to leak kernel information from /proc/net/rose and do local privilege escalation in other ways.
Tested it on Linux-5.17.rc5.
A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing skuserdata can lead to a race condition and NULL pointer dereference. A local user could use this flaw to potentially crash the system causing a denial of service.
A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVMEIOCTLRESET and the NVMEIOCTLSUBSYSRESET through the device file of the driver, resulting in a PCIe link disconnect.
A flaw was found in hw. Non-transparent sharing of branch predictor targets between contexts in some Intel(R) processors may potentially allow an authorized user to enable information disclosure via local access.
Last updated 25 April 2025
Last updated 25 April 2025
A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions.
A flaw was found in hw. Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type, potentially leading to information disclosure.
Last updated 11 April 2025
Last updated 25 April 2025
A heap out of bounds read vulnerability was discovered in the function WavpackPackSamples(). https://github.com/dbry/WavPack/issues/110
A bug in the Linux kernel version 6.2.0 by syzkaller with our own templates. The bug causes a possible recursive locking scenario, resulting in a deadlock.
The key trace is as follows:
downread+0x9d/0x450 kernel/locking/rwsem.c:1509 dmgetinactivetable+0x2b/0xc0 drivers/md/dm-ioctl.c:773 devstatus+0x4fd/0x7c0 drivers/md/dm-ioctl.c:844 tableclear+0x197/0x280 drivers/md/dm-ioctl.c:1537
In tableclear, it acquires a write lock https://elixir.bootlin.com/linux/v6.2/source/drivers/md/dm-ioctl.c#L1520 downwrite(&hashlock);
Then before the lock is released at L1539, there is a path shown above: tableclear -> devstatus -> dmgetinactivetable -> downread
https://elixir.bootlin.com/linux/v6.2/source/drivers/md/dm-ioctl.c#L773 downread(&hashlock);
It tries to acquire the same read lock again, resulting in the deadlock problem
A vulnerability was found in Libiberty. A heap and stack buffer overflow found in the dlanglname function in d-demangle.c leads to a denial of service.