A Heap Use After Free (UAF) vulnerability was discovered in the Schematron in the libxml2. The issue arises in the xmlSchematronGetNode function when processing XPath expressions in Schematron schema elements <sch:name path="..."/>, where a pointer to freed memory is returned and then accessed, leading to undefined behavior and potential crashes.
A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.
In the Linux kernel, the following vulnerability has been resolved:
e1000e: fix heap overflow in e1000seteeprom
In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix race condition in mptcpschedulework()
syzbot reported use-after-free in mptcpschedulework() [1]
Issue here is that mptcpschedulework() schedules a work, then gets a refcount on sk->skrefcnt if the work was scheduled. This refcount will be released by mptcpworker().
[A] if (schedulework(...)) { [B] sockhold(sk); return true; }
Problem is that mptcpworker() can run immediately and complete before [B]
We need instead :
sockhold(sk); if (schedulework(...)) return true; sockput(sk);
[1] refcountt: addition on 0; use-after-free. WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcountwarnsaturate+0xfa/0x1d0 lib/refcount.c:25 Call Trace: <TASK> refcountadd include/linux/refcount.h:-1 [inline] refcountinc include/linux/refcount.h:366 [inline] refcountinc include/linux/refcount.h:383 [inline] sockhold include/net/sock.h:816 [inline] mptcpschedulework+0x164/0x1a0 net/mptcp/protocol.c:943 mptcptouttimer+0x21/0xa0 net/mptcp/protocol.c:2316 calltimerfn+0x17e/0x5f0 kernel/time/timer.c:1747 expiretimers kernel/time/timer.c:1798 [inline] runtimers kernel/time/timer.c:2372 [inline] runtimerbase+0x648/0x970 kernel/time/timer.c:2384 runtimerbase kernel/time/timer.c:2393 [inline] runtimersoftirq+0xb7/0x180 kernel/time/timer.c:2403 handlesoftirqs+0x22f/0x710 kernel/softirq.c:622 dosoftirq kernel/softirq.c:656 [inline] runktimerd+0xcf/0x190 kernel/softirq.c:1138 smpbootthreadfn+0x542/0xa60 kernel/smpboot.c:160 kthread+0x711/0x8a0 kernel/kthread.c:463 retfromfork+0x4bc/0x870 arch/x86/kernel/process.c:158 retfromforkasm+0x1a/0x30 arch/x86/entry/entry64.S:245
net-snmp is a SNMP application library, tools and daemon. Prior to versions 5.9.5 and 5.10.pre2, a specially crafted packet to an net-snmp snmptrapd daemon can cause a buffer overflow and the daemon to crash. This issue has been patched in versions 5.9.5 and 5.10.pre2.
IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.
gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4CONNMSGLEN is not sufficient for a trailing '\0' character.
In some modssl configurations on Apache HTTP Server 2.4.35 through to 2.4.62, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when modssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.
BZ2decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.