Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

A GDBus authentication denial-of-service / resource exhaustion flaw has been reported. The vulnerability involves a lack of line length limitations when gdbusauth reads input from a client. This can be exploited by an unauthenticated remote or local attacker to cause excessive memory and CPU consumption.

In display, there is a possible escalation of privilege due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11019183; Issue ID: MSV-7758.

In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11004276; Issue ID: MSV-7748.

In the Linux kernel, the following vulnerability has been resolved:

ipv4: fib: free fibalias with kfreercu() on insert error path

fibtableinsert() publishes newfa into the leaf's falist with fibinsertalias() before calling the fib entry notifiers. When a notifier fails, the error path removes newfa with fibremovealias() (hlistdelrcu) and frees it right away with kmemcachefree().

fibtablelookup() walks that list under rcureadlock() only, so a concurrent lookup that already reached newfa keeps reading it after the free:

BUG: KASAN: slab-use-after-free in fibtablelookup (net/ipv4/fibtrie.c:1601) Read of size 1 at addr ffff88810676d4eb by task exploit/297 Call Trace: fibtablelookup (net/ipv4/fibtrie.c:1601) iprouteoutputkeyhashrcu (net/ipv4/route.c:2814) iprouteoutputkeyhash (net/ipv4/route.c:2705) ip4datagramconnect (net/ipv4/datagram.c:49) udpconnect (net/ipv4/udp.c:2144) sysconnect (net/socket.c:2167) x64sysconnect (net/socket.c:2173) dosyscall64 entrySYSCALL64afterhwframe which belongs to the cache ipfibalias of size 56

Triggering the error path needs CAPNETADMIN and a registered fib notifier that can reject a route; a netdevsim device whose IPv4 FIB resource is exhausted is enough.

Free newfa with aliasfreememrcu(), as fibtabledelete() already does for a fibalias removed from the trie.

In the Linux kernel, the following vulnerability has been resolved:

xfrm: policy: preallocate inexact bins before xfrmhashrebuild reinsert

xfrmhashrebuild()'s first loop preallocates the bins/chains the reinsert loop needs, so the reinsert (after hlistdelrcu()) cannot allocate or fail. But its guard is inverted: it skips policies with prefixlen < threshold and preallocates for the rest.

prefixlen < threshold is exactly when policyhashbysel() returns NULL and the reinsert takes the allocating xfrmpolicyinexactinsert() path. So the loop preallocates for the exact policies (which never allocate) and skips the inexact ones, whose bin/node is then allocated GFPATOMIC during reinsert. On failure the error path only WARNONCE()s and continues, leaving a poisoned bydst node; the next rebuild's hlistdelrcu() dereferences LISTPOISON2 and takes a GPF. Reachable under memory pressure, deterministic via failslab.

Invert the guard so preallocation covers exactly the reinserted policies; the reinsert then allocates nothing and cannot fail.

Crash: Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0xdead...] ... Workqueue: events xfrmhashrebuild RIP: 0010:xfrmhashrebuild+0x5b3/0x1190 RAX: dead000000000122 (LISTPOISON2 + offset) ... Call Trace: hlistdelrcu (include/linux/rculist.h:599) xfrmhashrebuild (net/xfrm/xfrmpolicy.c:1365) processonework (kernel/workqueue.c:3322) workerthread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) retfromfork (arch/x86/kernel/process.c:158) retfromforkasm (arch/x86/entry/entry64.S:245) ... Kernel panic - not syncing: Fatal exception in interrupt

Bluetooth: qca: fix NVM tag length underflow in TLV parser

In the Linux kernel, the following vulnerability has been resolved:

mpls: fix NULL deref in mplsvalidfibdumpreq() on CONFIGINET=n

On CONFIGINET=n builds, mplsvalidfibdumpreq() walks the parsed attribute table itself instead of calling ipvalidfibdumpreq(). The RTAOIF arm passes tb[RTAOIF] to nlagetu32() without checking it is present, so an RTMGETROUTE dump for AFMPLS with strict checking and no RTAOIF hits a NULL dereference.

RTMGETROUTE is RTNLKINDGET, which rtnetlinkrcvmsg() permits without CAPNETADMIN, so an unprivileged user can trigger it.

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:mplsvalidfibdumpreq (net/mpls/afmpls.c:2189) Call Trace: mplsdumproutes (net/mpls/afmpls.c:2236) netlinkdump (net/netlink/afnetlink.c:2331) netlinkdumpstart (net/netlink/afnetlink.c:2446) rtnetlinkrcvmsg (net/core/rtnetlink.c:7033) netlinkrcvskb (net/netlink/afnetlink.c:2556) netlinkunicast (net/netlink/afnetlink.c:1345) netlinksendmsg (net/netlink/afnetlink.c:1900) socksendmsg (net/socket.c:790) syssendmsg (net/socket.c:2684) syssendmsg (net/socket.c:2738) syssendmsg (net/socket.c:2770) dosyscall64 (arch/x86/entry/syscall64.c:94) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:121)

Skip unset attributes, as ipvalidfibdumpreq() does.

In the Linux kernel, the following vulnerability has been resolved:

x86/bugs: Enable IBPB flush on BPF JIT allocation

Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip enabling the IBPB flush if the BPF dispatcher is already using a retpoline sequence.

This hardening applies only when BPF-JIT is in use. Guard the enabling under CONFIGBPFJIT so that bugs.c still builds with CONFIGBPFJIT=n.

In the Linux kernel, the following vulnerability has been resolved:

ipv6: ndisc: fix NULL deref in acceptuntrackedna()

acceptuntrackedna() re-fetches the inet6dev with in6devget(dev) and dereferences idev->cnf.acceptuntrackedna without a NULL check, even though its only caller ndiscrecvna() already fetched and NULL-checked idev for the same device.

Both reads of dev->ip6ptr run in the same RCU read-side critical section, but a concurrent addrconfifdown() can clear dev->ip6ptr between them: lowering the MTU below IPV6MINMTU calls addrconfifdown() without the synchronizenet() that orders the unregister path, so the re-fetch returns NULL and oopses:

BUG: KASAN: null-ptr-deref in ndiscrecvna (net/ipv6/ndisc.c:974) Read of size 4 at addr 0000000000000364 Call Trace: <IRQ> ndiscrecvna (net/ipv6/ndisc.c:974) icmpv6rcv (net/ipv6/icmp.c:1193) ip6protocoldeliverrcu (net/ipv6/ip6input.c:479) ip6inputfinish (net/ipv6/ip6input.c:534) ip6input (net/ipv6/ip6input.c:545) ip6mcinput (net/ipv6/ip6input.c:635) ipv6rcv (net/ipv6/ip6input.c:351) </IRQ>

It is reachable by an unprivileged user via a network namespace.

Pass the caller's already validated idev instead of re-fetching it; the idev stays alive for the whole RCU critical section, so it is safe even after dev->ip6ptr has been cleared.

Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Microsoft SharePoint Server Spoofing Vulnerability

Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.

Microsoft Excel Information Disclosure Vulnerability

Microsoft Office Graphics Component Information Disclosure Vulnerability

Microsoft Excel Information Disclosure Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

Microsoft Office Word Information Disclosure Vulnerability

Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

Buffer over-read in Windows SMB Client allows an unauthorized attacker to disclose information over a network.

No cwe for this issue in Windows DNS allows an authorized attacker to elevate privileges locally.

futex: Prevent lockup in requeue-PI during signal/ timeout wakeup

Active Directory Security Feature Bypass Vulnerability

Improper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized attacker to elevate privileges locally.

Insufficiently protected credentials in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

Microsoft Office Word Information Disclosure Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Microsoft Office Information Disclosure Vulnerability