admin/nvd-json-data-feeds
1
0 Fork 0
mirror of https://github.com/fkie-cad/nvd-json-data-feeds.git synced 2026-10-29 01:10:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auto-Update: 2025-08-22T18:00:12.057661+00:00

Browse Source
This commit is contained in:
cad-safe-bot committed 2025-08-22 18:03:53 +00:00
1 parent 2602b42e44
commit 4fc5d8427f
159 files changed
+5744 -375
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

CVE-2009/CVE-2009-200xx/CVE-2009-20002.json
+13 -1
View File
@@ -2,7 +2,7 @@
"id": "CVE-2009-20002",
"sourceIdentifier": "[email protected]",
"published": "2025-08-21T21:15:32.207",
"lastModified": "2025-08-21T21:15:32.207",
"lastModified": "2025-08-22T16:15:30.107",
"vulnStatus": "Received",
"cveTags": [
{
@@ -16,6 +16,10 @@
{
"lang": "en",
"value": "Millenium MP3 Studio versions up to and including 2.0 is vulnerable to a stack-based buffer overflow when parsing .pls playlist files. The application fails to properly validate the length of the File1 field within the playlist, allowing an attacker to craft a malicious .pls file that overwrites the Structured Exception Handler (SEH) and executes arbitrary code. Exploitation requires the victim to open the file locally, though remote execution may be possible if the .pls extension is registered to the application and opened via a browser."
},
{
"lang": "es",
"value": "Las versiones de Millenium MP3 Studio hasta la 2.0 incluida son vulnerables a un desbordamiento de b\u00fafer basado en pila al analizar archivos de listas de reproducci\u00f3n .pls. La aplicaci\u00f3n no valida correctamente la longitud del campo File1 dentro de la lista de reproducci\u00f3n, lo que permite a un atacante manipular un archivo .pls malicioso que sobrescribe el Gestor de Excepciones Estructuradas (SEH) y ejecuta c\u00f3digo arbitrario. Para explotar esta vulnerabilidad, la v\u00edctima debe abrir el archivo localmente, aunque la ejecuci\u00f3n remota podr\u00eda ser posible si la extensi\u00f3n .pls est\u00e1 registrada en la aplicaci\u00f3n y se abre mediante un navegador."
}
],
"metrics": {
@@ -100,6 +104,14 @@
{
"url": "https://www.vulncheck.com/advisories/millenium-mp3-studio-pls-file-stack-based-buffer-overflow",
"source": "[email protected]"
},
{
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/millenium_mp3_pls.rb",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/9618",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2009/CVE-2009-200xx/CVE-2009-20004.json
+21 -1
View File
@@ -2,7 +2,7 @@
"id": "CVE-2009-20004",
"sourceIdentifier": "[email protected]",
"published": "2025-08-21T21:15:33.087",
"lastModified": "2025-08-21T21:15:33.087",
"lastModified": "2025-08-22T16:15:31.230",
"vulnStatus": "Received",
"cveTags": [
{
@@ -16,6 +16,10 @@
{
"lang": "en",
"value": "gAlan 0.2.1, a modular audio processing environment for Windows, is vulnerable to a stack-based buffer overflow when parsing .galan files. The application fails to properly validate the length of input data, allowing a specially crafted file to overwrite the stack and execute arbitrary code. Exploitation requires local interaction, typically by convincing a user to open the malicious file."
},
{
"lang": "es",
"value": "gAlan 0.2.1, un entorno modular de procesamiento de audio para Windows, es vulnerable a un desbordamiento de b\u00fafer basado en la pila al analizar archivos .galan. La aplicaci\u00f3n no valida correctamente la longitud de los datos de entrada, lo que permite que un archivo especialmente manipulado sobrescriba la pila y ejecute c\u00f3digo arbitrario. La explotaci\u00f3n requiere interacci\u00f3n local, generalmente convenciendo al usuario para que abra el archivo malicioso."
}
],
"metrics": {
@@ -104,6 +108,22 @@
{
"url": "https://www.vulncheck.com/advisories/galan-buffer-overflow",
"source": "[email protected]"
},
{
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/galan_fileformat_bof.rb",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/10339",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/10345",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/16664",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2010/CVE-2010-100xx/CVE-2010-10014.json
+13 -1
View File
@@ -2,7 +2,7 @@
"id": "CVE-2010-10014",
"sourceIdentifier": "[email protected]",
"published": "2025-08-20T16:15:33.227",
"lastModified": "2025-08-20T16:15:33.227",
"lastModified": "2025-08-22T16:15:31.377",
"vulnStatus": "Received",
"cveTags": [
{
@@ -16,6 +16,10 @@
{
"lang": "en",
"value": "Odin Secure FTP <= 4.1 is vulnerable to a stack-based buffer overflow when parsing directory listings received in response to an FTP LIST command. A malicious FTP server can send an overly long filename in the directory listing, which overflows a fixed-size stack buffer in the client and overwrites the Structured Exception Handler (SEH). This allows remote attackers to execute arbitrary code on the client system."
},
{
"lang": "es",
"value": "Odin Secure FTP (versi\u00f3n &lt;= 4.1) es vulnerable a un desbordamiento de b\u00fafer basado en la pila al analizar las listas de directorios recibidas en respuesta a un comando FTP LIST. Un servidor FTP malicioso puede enviar un nombre de archivo demasiado largo en la lista de directorios, lo que desborda un b\u00fafer de pila de tama\u00f1o fijo en el cliente y sobrescribe el Gestor de Excepciones Estructurado (SEH). Esto permite a atacantes remotos ejecutar c\u00f3digo arbitrario en el sistema cliente."
}
],
"metrics": {
@@ -96,6 +100,14 @@
{
"url": "https://www.vulncheck.com/advisories/odin-secure-ftp-stack-buffer-overflow-via-list-response",
"source": "[email protected]"
},
{
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/odin_list_reply.rb",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/16716",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2010/CVE-2010-100xx/CVE-2010-10015.json
+17 -1
View File
@@ -2,13 +2,17 @@
"id": "CVE-2010-10015",
"sourceIdentifier": "[email protected]",
"published": "2025-08-21T20:15:30.633",
"lastModified": "2025-08-21T20:15:30.633",
"lastModified": "2025-08-22T16:15:31.530",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "AOL versions up to and including 9.5 includes an ActiveX control (Phobos.dll) that exposes a method called Import() via the Phobos.Playlist COM object. This method is vulnerable to a stack-based buffer overflow when provided with an excessively long string argument. Exploitation allows remote attackers to execute arbitrary code in the context of the user, but only when the malicious HTML file is opened locally, due to the control not being marked safe for scripting or initialization.\u00a0AOL remains an active and supported brand offering services like AOL Mail and AOL Desktop Gold, but the legacy AOL 9.5 desktop software\u2014specifically the version containing the vulnerable Phobos.dll ActiveX control\u2014is long discontinued and no longer maintained."
},
{
"lang": "es",
"value": "Las versiones de AOL hasta la 9.5 incluida incluyen un control ActiveX (Phobos.dll) que expone un m\u00e9todo llamado Import() a trav\u00e9s del objeto COM Phobos.Playlist. Este m\u00e9todo es vulnerable a un desbordamiento de b\u00fafer basado en la pila cuando se le proporciona un argumento de cadena excesivamente largo. Esta explotaci\u00f3n permite a atacantes remotos ejecutar c\u00f3digo arbitrario en el contexto del usuario, pero solo cuando el archivo HTML malicioso se abre localmente, ya que el control no est\u00e1 marcado como seguro para scripting o inicializaci\u00f3n. AOL sigue siendo una marca activa y con soporte, que ofrece servicios como AOL Mail y AOL Desktop Gold, pero el software de escritorio heredado de AOL 9.5 \u2014en concreto, la versi\u00f3n que contiene el control ActiveX vulnerable Phobos.dll\u2014 lleva tiempo descontinuado y sin mantenimiento."
}
],
"metrics": {
@@ -101,6 +105,18 @@
{
"url": "https://www.vulncheck.com/advisories/aol-phobos-playlist-import-stack-based-buffer-overflow",
"source": "[email protected]"
},
{
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/aol_phobos_bof.rb",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/11190",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/11204",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2010/CVE-2010-200xx/CVE-2010-20007.json
+13 -1
View File
@@ -2,7 +2,7 @@
"id": "CVE-2010-20007",
"sourceIdentifier": "[email protected]",
"published": "2025-08-21T21:15:33.267",
"lastModified": "2025-08-21T21:15:33.267",
"lastModified": "2025-08-22T16:15:31.683",
"vulnStatus": "Received",
"cveTags": [
{
@@ -16,6 +16,10 @@
{
"lang": "en",
"value": "Seagull FTP Client <= v3.3 Build 409 contains a stack-based buffer overflow vulnerability in its FTP directory listing parser. When the client connects to an FTP server and receives a crafted response to a LIST command containing an excessively long filename, the application fails to properly validate input length, resulting in a buffer overflow that overwrites the Structured Exception Handler (SEH). This may allow remote attackers to execute arbitrary code on the client system. This product line was discontinued and users were advised to use BlueZone Secure FTP instead, at the time of disclosure."
},
{
"lang": "es",
"value": "Seagull FTP Client (versi\u00f3n 3.3, compilaci\u00f3n 409) presenta una vulnerabilidad de desbordamiento de b\u00fafer en su analizador de listados de directorios FTP. Cuando el cliente se conecta a un servidor FTP y recibe una respuesta manipulada a un comando LIST con un nombre de archivo excesivamente largo, la aplicaci\u00f3n no valida correctamente la longitud de la entrada, lo que provoca un desbordamiento de b\u00fafer que sobrescribe el Gestor de Excepciones Estructuradas (SEH). Esto podr\u00eda permitir que atacantes remotos ejecuten c\u00f3digo arbitrario en el sistema cliente. Esta l\u00ednea de productos se discontinu\u00f3 y se recomend\u00f3 a los usuarios utilizar BlueZone Secure FTP en su lugar en el momento de la divulgaci\u00f3n."
}
],
"metrics": {
@@ -100,6 +104,14 @@
{
"url": "https://www3.rocketsoftware.com/bluezone/help/v34/sftp/sftp.htm",
"source": "[email protected]"
},
{
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/seagull_list_reply.rb",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/16705",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2010/CVE-2010-200xx/CVE-2010-20034.json
+13 -1
View File
@@ -2,7 +2,7 @@
"id": "CVE-2010-20034",
"sourceIdentifier": "[email protected]",
"published": "2025-08-21T21:15:33.443",
"lastModified": "2025-08-21T21:15:33.443",
"lastModified": "2025-08-22T16:15:31.830",
"vulnStatus": "Received",
"cveTags": [
{
@@ -16,6 +16,10 @@
{
"lang": "en",
"value": "Gekko Manager FTP Client <= 0.77 contains a stack-based buffer overflow in its FTP directory listing parser. When processing a server response to a LIST command, the client fails to properly validate the length of filenames. A crafted response containing an overly long filename can overwrite the Structured Exception Handler (SEH), potentially allowing remote code execution."
},
{
"lang": "es",
"value": "Gekko Manager FTP Client (versi\u00f3n &lt;= 0.77) presenta un desbordamiento de b\u00fafer basado en pila en su analizador de listados de directorios FTP. Al procesar una respuesta del servidor a un comando LIST, el cliente no valida correctamente la longitud de los nombres de archivo. Una respuesta manipulada con un nombre de archivo demasiado largo puede sobrescribir el Gestor de Excepciones Estructuradas (GEH), lo que podr\u00eda permitir la ejecuci\u00f3n remota de c\u00f3digo."
}
],
"metrics": {
@@ -96,6 +100,14 @@
{
"url": "https://www.vulncheck.com/advisories/gekko-manager-ftp-client-stack-buffer-overflow",
"source": "[email protected]"
},
{
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/gekkomgr_list_reply.rb",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/16728",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2010/CVE-2010-200xx/CVE-2010-20049.json
+13 -1
View File
@@ -2,7 +2,7 @@
"id": "CVE-2010-20049",
"sourceIdentifier": "[email protected]",
"published": "2025-08-20T16:15:33.773",
"lastModified": "2025-08-20T16:15:33.773",
"lastModified": "2025-08-22T17:15:29.750",
"vulnStatus": "Received",
"cveTags": [
{
@@ -16,6 +16,10 @@
{
"lang": "en",
"value": "LeapFTP <\u00a03.1.x contains a stack-based buffer overflow vulnerability in its FTP client parser. When the client receives a directory listing containing a filename longer than 528 bytes, the application fails to properly bound-check the input and overwrites the Structured Exception Handler (SEH) chain. This allows an attacker operating a malicious FTP server to execute arbitrary code on the victim\u2019s machine when the file is listed or downloaded."
},
{
"lang": "es",
"value": "LeapFTP &lt; 3.1.x contiene una vulnerabilidad de desbordamiento de b\u00fafer basada en pila en el analizador de su cliente FTP. Cuando el cliente recibe una lista de directorios con un nombre de archivo de m\u00e1s de 528 bytes, la aplicaci\u00f3n no realiza la comprobaci\u00f3n de enlace correcta de la entrada y sobrescribe la cadena del Gestor de Excepciones Estructuradas (SEH). Esto permite que un atacante que opere un servidor FTP malicioso ejecute c\u00f3digo arbitrario en el equipo de la v\u00edctima cuando el archivo se lista o se descarga."
}
],
"metrics": {
@@ -96,6 +100,14 @@
{
"url": "https://www.vulncheck.com/advisories/leapftp-stack-buffer-overflow",
"source": "[email protected]"
},
{
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/leapftp_list_reply.rb",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/16704",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2010/CVE-2010-200xx/CVE-2010-20059.json
+13 -1
View File
@@ -2,13 +2,17 @@
"id": "CVE-2010-20059",
"sourceIdentifier": "[email protected]",
"published": "2025-08-20T16:15:33.953",
"lastModified": "2025-08-20T16:15:33.953",
"lastModified": "2025-08-22T17:15:30.833",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "FreeNAS 0.7.2 prior to revision 5543 includes an unauthenticated command\u2010execution backdoor in its web interface. The exec_raw.php script exposes a cmd parameter that is passed directly to the underlying shell without sanitation."
},
{
"lang": "es",
"value": "FreeNAS 0.7.2, anterior a la revisi\u00f3n 5543, incluye una puerta trasera de ejecuci\u00f3n de comandos no autenticados en su interfaz web. El script exec_raw.php expone un par\u00e1metro cmd que se pasa directamente al shell subyacente sin depurar."
}
],
"metrics": {
@@ -101,6 +105,14 @@
{
"url": "https://www.vulncheck.com/advisories/freenas-arbitrary-command-execution",
"source": "[email protected]"
},
{
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/freenas_exec_raw.rb",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/16313",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2010/CVE-2010-201xx/CVE-2010-20103.json
+17 -1
View File
@@ -2,13 +2,17 @@
"id": "CVE-2010-20103",
"sourceIdentifier": "[email protected]",
"published": "2025-08-20T16:15:34.137",
"lastModified": "2025-08-20T16:15:34.137",
"lastModified": "2025-08-22T16:15:31.983",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host."
},
{
"lang": "es",
"value": "Una puerta trasera maliciosa se integr\u00f3 en official ProFTPD 1.3.3c source tarball, distribuido entre el 28 de noviembre y el 2 de diciembre de 2010. Esta puerta trasera implementa un disparador de comandos FTP oculto que, al ser invocado, provoca que el servidor ejecute comandos de shell arbitrarios con privilegios de root. Esto permite a atacantes remotos no autenticados ejecutar cualquier comando del sistema operativo en el host del servidor FTP."
}
],
"metrics": {
@@ -101,6 +105,18 @@
{
"url": "https://www.vulncheck.com/advisories/proftpd-backdoor-command-execution",
"source": "[email protected]"
},
{
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/ftp/proftpd_133c_backdoor.rb",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/15662",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/16921",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2010/CVE-2010-201xx/CVE-2010-20107.json
+13 -1
View File
@@ -2,13 +2,17 @@
"id": "CVE-2010-20107",
"sourceIdentifier": "[email protected]",
"published": "2025-08-21T21:15:33.610",
"lastModified": "2025-08-21T21:15:33.610",
"lastModified": "2025-08-22T16:15:32.130",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A stack-based buffer overflow exists in FTP Synchronizer Professional <= v4.0.73.274. When the client connects to an FTP server and issues a LIST command\u2014typically during sync preview or profile creation\u2014the server\u2019s response containing an overly long filename triggers a buffer overflow. This results in the corruption of the Structured Exception Handler (SEH), potentially allowing remote code execution."
},
{
"lang": "es",
"value": "Existe un desbordamiento de b\u00fafer basado en la pila en FTP Synchronizer Professional (versi\u00f3n anterior a la v4.0.73.274). Cuando el cliente se conecta a un servidor FTP y emite un comando LIST (normalmente durante la vista previa de la sincronizaci\u00f3n o la creaci\u00f3n de un perfil), la respuesta del servidor, que contiene un nombre de archivo demasiado largo, provoca un desbordamiento de b\u00fafer. Esto provoca la corrupci\u00f3n del Gestor de Excepciones Estructuradas (GEH), lo que podr\u00eda permitir la ejecuci\u00f3n remota de c\u00f3digo."
}
],
"metrics": {
@@ -93,6 +97,14 @@
{
"url": "https://www.vulncheck.com/advisories/ftp-synchronizer-professional-stack-buffer-overflow",
"source": "[email protected]"
},
{
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/ftpsynch_list_reply.rb",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/16720",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2010/CVE-2010-201xx/CVE-2010-20108.json
+13 -1
View File
@@ -2,7 +2,7 @@
"id": "CVE-2010-20108",
"sourceIdentifier": "[email protected]",
"published": "2025-08-21T21:15:33.780",
"lastModified": "2025-08-21T21:15:33.780",
"lastModified": "2025-08-22T16:15:32.273",
"vulnStatus": "Received",
"cveTags": [
{
@@ -16,6 +16,10 @@
{
"lang": "en",
"value": "FTPPad <= 1.2.0 contains a stack-based buffer overflow vulnerability in its FTP directory listing parser. When the client connects to an FTP server and receives a crafted response to a LIST command containing an excessively long directory and filename, the application fails to properly validate input length. This results in a buffer overflow that overwrites the saved Extended Instruction Pointer (EIP), allowing remote attackers to execute arbitrary code."
},
{
"lang": "es",
"value": "FTPPad &lt;= 1.2.0 contiene una vulnerabilidad de desbordamiento de b\u00fafer basada en pila en su analizador de listados de directorios FTP. Cuando el cliente se conecta a un servidor FTP y recibe una respuesta manipulada a un comando LIST que contiene un directorio y un nombre de archivo excesivamente largos, la aplicaci\u00f3n no valida correctamente la longitud de la entrada. Esto provoca un desbordamiento de b\u00fafer que sobrescribe el puntero de instrucci\u00f3n extendida (EIP) guardado, lo que permite a atacantes remotos ejecutar c\u00f3digo arbitrario."
}
],
"metrics": {
@@ -96,6 +100,14 @@
{
"url": "https://www.vulncheck.com/advisories/ftppad-stack-buffer-overflow",
"source": "[email protected]"
},
{
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/ftppad_list_reply.rb",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/16726",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2010/CVE-2010-201xx/CVE-2010-20112.json
+13 -1
View File
@@ -2,7 +2,7 @@
"id": "CVE-2010-20112",
"sourceIdentifier": "[email protected]",
"published": "2025-08-21T20:15:31.217",
"lastModified": "2025-08-21T20:15:31.217",
"lastModified": "2025-08-22T16:15:32.420",
"vulnStatus": "Received",
"cveTags": [
{
@@ -16,6 +16,10 @@
{
"lang": "en",
"value": "Amlib\u2019s NetOpacs webquery.dll contains a stack-based buffer overflow vulnerability triggered by improper handling of HTTP GET parameters. Specifically, the application fails to enforce bounds on input supplied to the app parameter, allowing excessive data to overwrite memory structures including the Structured Exception Handler (SEH). Additionally, malformed parameter names followed by an equals sign may result in unintended control flow behavior. This vulnerability is exposed through IIS and affects legacy Windows deployments"
},
{
"lang": "es",
"value": "El archivo webquery.dll de NetOpacs de Amlib contiene una vulnerabilidad de desbordamiento de b\u00fafer basada en pila, desencadenada por el manejo incorrecto de par\u00e1metros HTTP GET. En concreto, la aplicaci\u00f3n no aplica l\u00edmites a la entrada suministrada al par\u00e1metro app, lo que permite que un exceso de datos sobrescriba las estructuras de memoria, incluido el Gestor de Excepciones Estructuradas (SEH). Adem\u00e1s, los nombres de par\u00e1metros mal formados seguidos de un signo igual pueden provocar un comportamiento no deseado en el flujo de control. Esta vulnerabilidad se expone a trav\u00e9s de IIS y afecta a las implementaciones heredadas de Windows."
}
],
"metrics": {
@@ -100,6 +104,14 @@
{
"url": "https://www.vulncheck.com/advisories/amlibweb-netopacs-stack-buffer-overflow",
"source": "[email protected]"
},
{
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/amlibweb_webquerydll_app.rb",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/16793",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2010/CVE-2010-201xx/CVE-2010-20113.json
+13 -1
View File
@@ -2,7 +2,7 @@
"id": "CVE-2010-20113",
"sourceIdentifier": "[email protected]",
"published": "2025-08-21T21:15:33.957",
"lastModified": "2025-08-21T21:15:33.957",
"lastModified": "2025-08-22T16:15:32.563",
"vulnStatus": "Received",
"cveTags": [
{
@@ -16,6 +16,10 @@
{
"lang": "en",
"value": "EasyFTP Server 1.7.0.11 and earlier contains a stack-based buffer overflow vulnerability in its HTTP interface. When processing a GET request to list.html, the server fails to properly validate the length of the path parameter. Supplying an excessively long value causes a buffer overflow on the stack, potentially corrupting control flow structures. The vulnerability is exposed through the embedded web server and does not require authentication due to default anonymous access. The issue was resolved in version 1.7.0.12, after which the product was renamed to UplusFtp."
},
{
"lang": "es",
"value": "EasyFTP Server 1.7.0.11 y versiones anteriores contienen una vulnerabilidad de desbordamiento de b\u00fafer en la pila de su interfaz HTTP. Al procesar una solicitud GET a list.html, el servidor no valida correctamente la longitud del par\u00e1metro path. Proporcionar un valor excesivamente largo provoca un desbordamiento de b\u00fafer en la pila, lo que podr\u00eda da\u00f1ar las estructuras del flujo de control. La vulnerabilidad se expone a trav\u00e9s del servidor web integrado y no requiere autenticaci\u00f3n debido al acceso an\u00f3nimo predeterminado. El problema se resolvi\u00f3 en la versi\u00f3n 1.7.0.12, tras lo cual el producto cambi\u00f3 su nombre a UplusFtp."
}
],
"metrics": {
@@ -88,6 +92,14 @@
{
"url": "https://www.vulncheck.com/advisories/easyftp-server-list-html-stack-buffer-overflow",
"source": "[email protected]"
},
{
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/easyftp_list.rb",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/11500",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2010/CVE-2010-201xx/CVE-2010-20120.json
+13 -1
View File
@@ -2,13 +2,17 @@
"id": "CVE-2010-20120",
"sourceIdentifier": "[email protected]",
"published": "2025-08-21T21:15:34.507",
"lastModified": "2025-08-21T21:15:34.507",
"lastModified": "2025-08-22T16:15:32.710",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Maple versions up to and including 13's Maplet framework allows embedded commands to be executed automatically when a .maplet file is opened. This behavior bypasses standard security restrictions that normally prevent code execution in regular Maple worksheets. The vulnerability enables attackers to craft malicious .maplet files that execute arbitrary code without user interaction."
},
{
"lang": "es",
"value": "Las versiones de Maple hasta la 13 (incluida la versi\u00f3n 13) permiten que los comandos incrustados se ejecuten autom\u00e1ticamente al abrir un archivo .maplet. Este comportamiento elude las restricciones de seguridad est\u00e1ndar que normalmente impiden la ejecuci\u00f3n de c\u00f3digo en hojas de c\u00e1lculo de Maple. Esta vulnerabilidad permite a los atacantes manipular archivos .maplet maliciosos que ejecutan c\u00f3digo arbitrario sin la interacci\u00f3n del usuario."
}
],
"metrics": {
@@ -89,6 +93,14 @@
{
"url": "https://www.vulncheck.com/advisories/maple-maplet-file-creation-command-execution",
"source": "[email protected]"
},
{
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/fileformat/maple_maplet.rb",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/16308",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2010/CVE-2010-201xx/CVE-2010-20121.json
+29 -1
View File
@@ -2,13 +2,17 @@
"id": "CVE-2010-20121",
"sourceIdentifier": "[email protected]",
"published": "2025-08-21T20:15:31.610",
"lastModified": "2025-08-21T20:15:31.610",
"lastModified": "2025-08-22T16:15:32.850",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "EasyFTP Server versions up to 1.7.0.11 contain a stack-based buffer overflow vulnerability in the FTP command parser. When processing the CWD (Change Working Directory) command, the server fails to properly validate the length of the input string, allowing attackers to overwrite memory on the stack. This flaw enables remote code execution without authentication, as EasyFTP allows anonymous access by default. The vulnerability was resolved in version 1.7.0.12, after which the product was renamed \u201cUplusFtp.\u201d"
},
{
"lang": "es",
"value": "Las versiones de EasyFTP Server hasta la 1.7.0.11 contienen una vulnerabilidad de desbordamiento de b\u00fafer en la pila del analizador de comandos FTP. Al procesar el comando CWD (Cambiar directorio de trabajo), el servidor no valida correctamente la longitud de la cadena de entrada, lo que permite a los atacantes sobrescribir la memoria en la pila. Esta falla permite la ejecuci\u00f3n remota de c\u00f3digo sin autenticaci\u00f3n, ya que EasyFTP permite el acceso an\u00f3nimo por defecto. La vulnerabilidad se resolvi\u00f3 en la versi\u00f3n 1.7.0.12, tras la cual el producto pas\u00f3 a llamarse \"UplusFtp\"."
}
],
"metrics": {
@@ -101,6 +105,30 @@
{
"url": "https://www.vulncheck.com/advisories/easyftp-server-cwd-command-stack-buffer-overflow",
"source": "[email protected]"
},
{
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/easyftp_cwd_fixret.rb",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://seclists.org/bugtraq/2010/Feb/202",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/11668",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/12312",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/14402",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/16737",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2010/CVE-2010-201xx/CVE-2010-20123.json
+17 -1
View File
@@ -2,7 +2,7 @@
"id": "CVE-2010-20123",
"sourceIdentifier": "[email protected]",
"published": "2025-08-21T21:15:34.853",
"lastModified": "2025-08-21T21:15:34.853",
"lastModified": "2025-08-22T16:15:33.003",
"vulnStatus": "Received",
"cveTags": [
{
@@ -16,6 +16,10 @@
{
"lang": "en",
"value": "Steinberg MyMP3Player version 3.0 (build 3.0.0.67) is vulnerable to a stack-based buffer overflow when parsing .m3u playlist files. The application fails to properly validate the length of input data within the playlist, allowing a specially crafted file to overwrite critical memory structures and execute arbitrary code. This vulnerability can be exploited locally by convincing a user to open a malicious .m3u file."
},
{
"lang": "es",
"value": "Steinberg MyMP3Player versi\u00f3n 3.0 (compilaci\u00f3n 3.0.0.67) es vulnerable a un desbordamiento de b\u00fafer basado en la pila al analizar archivos de listas de reproducci\u00f3n .m3u. La aplicaci\u00f3n no valida correctamente la longitud de los datos de entrada dentro de la lista de reproducci\u00f3n, lo que permite que un archivo especialmente manipulado sobrescriba estructuras de memoria cr\u00edticas y ejecute c\u00f3digo arbitrario. Esta vulnerabilidad puede explotarse localmente convenciendo al usuario para que abra un archivo .m3u malicioso."
}
],
"metrics": {
@@ -104,6 +108,18 @@
{
"url": "https://www.vulncheck.com/advisories/steinburg-mymp3player-buffer-overflow",
"source": "[email protected]"
},
{
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/mymp3player_m3u.rb",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/11791",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/16633",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2011/CVE-2011-100xx/CVE-2011-10020.json
+13 -1
View File
@@ -2,7 +2,7 @@
"id": "CVE-2011-10020",
"sourceIdentifier": "[email protected]",
"published": "2025-08-20T16:15:34.327",
"lastModified": "2025-08-20T16:15:34.327",
"lastModified": "2025-08-22T17:15:30.977",
"vulnStatus": "Received",
"cveTags": [
{
@@ -16,6 +16,10 @@
{
"lang": "en",
"value": "Kaillera Server version 0.86 is vulnerable to a denial-of-service condition triggered by sending a malformed UDP packet after the initial handshake. Once a client sends a valid HELLO0.83 packet and receives a response, any subsequent malformed packet causes the server to crash and become unresponsive. This flaw stems from improper input validation in the server\u2019s UDP packet handler, allowing unauthenticated remote attackers to disrupt service availability."
},
{
"lang": "es",
"value": "La versi\u00f3n 0.86 de Kaillera Server es vulnerable a una condici\u00f3n de denegaci\u00f3n de servicio (DDS) que se activa al enviar un paquete UDP malformado tras el protocolo de enlace inicial. Una vez que un cliente env\u00eda un paquete HELLO0.83 v\u00e1lido y recibe una respuesta, cualquier paquete malformado posterior provoca el bloqueo del servidor y deja de responder. Esta vulnerabilidad se debe a una validaci\u00f3n de entrada incorrecta en el controlador de paquetes UDP del servidor, lo que permite a atacantes remotos no autenticados interrumpir la disponibilidad del servicio."
}
],
"metrics": {
@@ -92,6 +96,14 @@
{
"url": "https://www.vulncheck.com/advisories/kaillera-server-dos-via-malformed-udp-packet",
"source": "[email protected]"
},
{
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/dos/windows/games/kaillera.rb",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/17460",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2011/CVE-2011-100xx/CVE-2011-10021.json
+17 -1
View File
@@ -2,13 +2,17 @@
"id": "CVE-2011-10021",
"sourceIdentifier": "[email protected]",
"published": "2025-08-20T16:15:34.510",
"lastModified": "2025-08-20T16:15:34.510",
"lastModified": "2025-08-22T17:15:31.127",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Magix Musik Maker 16 is vulnerable to a stack-based buffer overflow due to improper handling of .mmm arrangement files. The vulnerability arises from an unsafe strcpy() operation that fails to validate input length, allowing attackers to overwrite the Structured Exception Handler (SEH). By crafting a malicious .mmm file, an attacker can trigger the overflow when the file is opened, potentially leading to arbitrary code execution. This vulnerability was remediated in version 17."
},
{
"lang": "es",
"value": "Magix Musik Maker 16 es vulnerable a un desbordamiento de b\u00fafer basado en la pila debido al manejo incorrecto de archivos de arreglos .mmm. La vulnerabilidad surge de una operaci\u00f3n strcpy() insegura que no valida la longitud de entrada, lo que permite a los atacantes sobrescribir el Gestor de Excepciones Estructuradas (SEH). Al crear un archivo .mmm malicioso, un atacante puede provocar el desbordamiento al abrirlo, lo que podr\u00eda provocar la ejecuci\u00f3n de c\u00f3digo arbitrario. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 17."
}
],
"metrics": {
@@ -97,6 +101,18 @@
{
"url": "https://www.vulncheck.com/advisories/magix-musik-maker-stack-based-buffer-overflow",
"source": "[email protected]"
},
{
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/magix_musikmaker_16_mmm.rb",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/17313",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/17329",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2011/CVE-2011-100xx/CVE-2011-10023.json
+13 -1
View File
@@ -2,13 +2,17 @@
"id": "CVE-2011-10023",
"sourceIdentifier": "[email protected]",
"published": "2025-08-20T16:15:34.870",
"lastModified": "2025-08-20T16:15:34.870",
"lastModified": "2025-08-22T17:15:31.267",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "MJM QuickPlayer (likely now referred to as MJM Player) version 2010 contains a stack-based buffer overflow vulnerability triggered by opening a malicious .s3m music file. The flaw occurs due to improper bounds checking in the file parser, allowing an attacker to overwrite memory and execute arbitrary code. Exploitation is achieved via a crafted payload that bypasses DEP and ASLR protections using ROP techniques, and requires user interaction to open the file."
},
{
"lang": "es",
"value": "La versi\u00f3n 2010 de MJM QuickPlayer (probablemente ahora conocido como MJM Player) contiene una vulnerabilidad de desbordamiento de b\u00fafer basada en pila que se activa al abrir un archivo de m\u00fasica .s3m malicioso. La falla se produce debido a una comprobaci\u00f3n incorrecta de los l\u00edmites en el analizador de archivos, lo que permite a un atacante sobrescribir la memoria y ejecutar c\u00f3digo arbitrario. La explotaci\u00f3n se logra mediante un payload manipulado que elude las protecciones DEP y ASLR mediante t\u00e9cnicas ROP y requiere la interacci\u00f3n del usuario para abrir el archivo."
}
],
"metrics": {
@@ -89,6 +93,14 @@
{
"url": "https://www.vulncheck.com/advisories/mjm-quickplayer-s3m-stack-based-buffer-overflow",
"source": "[email protected]"
},
{
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/mjm_quickplayer_s3m.rb",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/17229",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2011/CVE-2011-100xx/CVE-2011-10024.json
+13 -1
View File
@@ -2,13 +2,17 @@
"id": "CVE-2011-10024",
"sourceIdentifier": "[email protected]",
"published": "2025-08-20T16:15:35.057",
"lastModified": "2025-08-20T16:15:35.057",
"lastModified": "2025-08-22T17:15:31.400",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "MJM Core Player (likely now referred to as MJM Player) 2011 is vulnerable to a stack-based buffer overflow when parsing specially crafted .s3m music files. The vulnerability arises from improper bounds checking in the file parser, allowing an attacker to overwrite memory on the stack and execute arbitrary code. Exploitation is triggered when a user opens a malicious .s3m file, and the exploit bypasses DEP and ASLR protections using a ROP chain."
},
{
"lang": "es",
"value": "MJM Core Player (probablemente ahora conocido como MJM Player) 2011 es vulnerable a un desbordamiento de b\u00fafer en la pila al analizar archivos de m\u00fasica .s3m especialmente manipulados. La vulnerabilidad se debe a una comprobaci\u00f3n incorrecta de los l\u00edmites en el analizador de archivos, lo que permite a un atacante sobrescribir memoria en la pila y ejecutar c\u00f3digo arbitrario. La vulnerabilidad se activa cuando un usuario abre un archivo .s3m malicioso y el exploit evade las protecciones DEP y ASLR mediante una cadena ROP."
}
],
"metrics": {
@@ -89,6 +93,14 @@
{
"url": "https://www.vulncheck.com/advisories/mjm-core-player-file-stack-based-buffer-overflow",
"source": "[email protected]"
},
{
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/mjm_coreplayer2011_s3m.rb",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/17230",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2011/CVE-2011-100xx/CVE-2011-10030.json
+17 -1
View File
@@ -2,13 +2,17 @@
"id": "CVE-2011-10030",
"sourceIdentifier": "[email protected]",
"published": "2025-08-20T16:15:36.150",
"lastModified": "2025-08-20T16:15:36.150",
"lastModified": "2025-08-22T16:15:33.140",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Foxit PDF Reader <\u00a0 4.3.1.0218 exposes a JavaScript API function, createDataObject(), that allows untrusted PDF content to write arbitrary files anywhere on disk. By embedding a malicious PDF that calls this API, an attacker can drop executables or scripts into privileged folders, leading to code execution the next time the system boots or the user logs in."
},
{
"lang": "es",
"value": "Foxit PDF Reader (versi\u00f3n anterior a la 4.3.1.0218) expone una funci\u00f3n de la API de JavaScript, createDataObject(), que permite que contenido PDF no confiable escriba archivos arbitrarios en cualquier lugar del disco. Al incrustar un PDF malicioso que llama a esta API, un atacante puede colocar archivos ejecutables o scripts en carpetas privilegiadas, lo que provoca la ejecuci\u00f3n de c\u00f3digo la pr\u00f3xima vez que el sistema se inicie o el usuario inicie sesi\u00f3n."
}
],
"metrics": {
@@ -89,6 +93,18 @@
{
"url": "https://www.vulncheck.com/advisories/foxit-pdf-reader-javascript-file-write",
"source": "[email protected]"
},
{
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/foxit_reader_filewrite.rb",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://scarybeastsecurity.blogspot.com/2011/03/dangerous-file-write-bug-in-foxit-pdf.html",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
},
{
"url": "https://www.exploit-db.com/exploits/16978",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}
CVE-2019/CVE-2019-89xx/CVE-2019-8998.json
+33 -1
View File
@@ -2,7 +2,7 @@
"id": "CVE-2019-8998",
"sourceIdentifier": "[email protected]",
"published": "2019-07-12T16:15:11.773",
"lastModified": "2024-11-21T04:50:47.273",
"lastModified": "2025-08-22T16:15:33.343",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
@@ -16,6 +16,28 @@
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.1,
"impactScore": 6.0
}
],
"cvssMetricV30": [
{
"source": "[email protected]",
@@ -65,6 +87,16 @@
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-413"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
CVE-2020/CVE-2020-69xx/CVE-2020-6932.json
+31 -1
View File
@@ -2,7 +2,7 @@
"id": "CVE-2020-6932",
"sourceIdentifier": "[email protected]",
"published": "2020-08-12T13:15:10.833",
"lastModified": "2024-11-21T05:36:21.940",
"lastModified": "2025-08-22T16:15:33.570",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
@@ -17,6 +17,26 @@
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.9,
"impactScore": 6.0
},
{
"source": "[email protected]",
"type": "Primary",
@@ -65,6 +85,16 @@
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-150"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
CVE-2021/CVE-2021-221xx/CVE-2021-22156.json
+31 -1
View File
@@ -2,7 +2,7 @@
"id": "CVE-2021-22156",
"sourceIdentifier": "[email protected]",
"published": "2021-08-17T19:15:08.057",
"lastModified": "2024-11-21T05:49:36.947",
"lastModified": "2025-08-22T16:15:33.777",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
@@ -17,6 +17,26 @@
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 6.0
},
{
"source": "[email protected]",
"type": "Primary",
@@ -65,6 +85,16 @@
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-190"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
CVE-2021/CVE-2021-320xx/CVE-2021-32025.json
+31 -1
View File
@@ -2,7 +2,7 @@
"id": "CVE-2021-32025",
"sourceIdentifier": "[email protected]",
"published": "2022-03-10T17:42:14.083",
"lastModified": "2024-11-21T06:06:44.353",
"lastModified": "2025-08-22T16:15:34.010",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
@@ -17,6 +17,26 @@
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.4,
"impactScore": 6.0
},
{
"source": "[email protected]",
"type": "Primary",
@@ -65,6 +85,16 @@
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-368"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
CVE-2023/CVE-2023-327xx/CVE-2023-32701.json
+2 -2
View File
@@ -2,13 +2,13 @@
"id": "CVE-2023-32701",
"sourceIdentifier": "[email protected]",
"published": "2023-11-14T19:15:27.163",
"lastModified": "2024-11-21T08:03:52.980",
"lastModified": "2025-08-22T16:15:34.237",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": " Improper Input Validation in the Networking Stack of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to potentially cause Information Disclosure or a Denial-of-Service condition. \n\n"
"value": "Improper Input Validation in the Networking Stack of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to potentially cause Information Disclosure or a Denial-of-Service condition."
},
{
"lang": "es",
CVE-2024/CVE-2024-132xx/CVE-2024-13200.json
+74 -7
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-13200",
"sourceIdentifier": "[email protected]",
"published": "2025-01-09T03:15:23.820",
"lastModified": "2025-01-09T03:15:23.820",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T16:54:51.633",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -80,6 +80,26 @@
},
"exploitabilityScore": 3.9,
"impactScore": 3.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"cvssMetricV2": [
@@ -122,28 +142,75 @@
"value": "CWE-284"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wander-chu:springboot-blog:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5E8E5F30-0B4E-48F8-89EE-86B696171DE6"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/wander-chu/SpringBoot-Blog/issues/4",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Issue Tracking"
]
},
{
"url": "https://github.com/wander-chu/SpringBoot-Blog/issues/4#issue-2761636207",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Issue Tracking"
]
},
{
"url": "https://vuldb.com/?ctiid.290793",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Permissions Required",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?id.290793",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?submit.470902",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
}
]
}
CVE-2024/CVE-2024-132xx/CVE-2024-13201.json
+74 -7
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-13201",
"sourceIdentifier": "[email protected]",
"published": "2025-01-09T03:15:24.020",
"lastModified": "2025-01-09T03:15:24.020",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T16:47:34.393",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -80,6 +80,26 @@
},
"exploitabilityScore": 1.2,
"impactScore": 3.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9
}
],
"cvssMetricV2": [
@@ -122,28 +142,75 @@
"value": "CWE-434"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-434"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wander-chu:springboot-blog:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5E8E5F30-0B4E-48F8-89EE-86B696171DE6"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/wander-chu/SpringBoot-Blog/issues/6",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Issue Tracking"
]
},
{
"url": "https://github.com/wander-chu/SpringBoot-Blog/issues/6#issue-2761640788",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Issue Tracking"
]
},
{
"url": "https://vuldb.com/?ctiid.290794",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Permissions Required",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?id.290794",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?submit.470910",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
}
]
}
CVE-2024/CVE-2024-132xx/CVE-2024-13202.json
+79 -8
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-13202",
"sourceIdentifier": "[email protected]",
"published": "2025-01-09T03:15:24.220",
"lastModified": "2025-01-09T17:15:12.110",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T16:46:09.560",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -80,6 +80,26 @@
},
"exploitabilityScore": 0.9,
"impactScore": 1.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7
}
],
"cvssMetricV2": [
@@ -122,32 +142,83 @@
"value": "CWE-94"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wander-chu:springboot-blog:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5E8E5F30-0B4E-48F8-89EE-86B696171DE6"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/wander-chu/SpringBoot-Blog/issues/7",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Issue Tracking"
]
},
{
"url": "https://github.com/wander-chu/SpringBoot-Blog/issues/7#issue-2761643235",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Issue Tracking"
]
},
{
"url": "https://vuldb.com/?ctiid.290795",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Permissions Required",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?id.290795",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?submit.470914",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://github.com/wander-chu/SpringBoot-Blog/issues/7#issue-2761643235",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Issue Tracking"
]
}
]
}
CVE-2024/CVE-2024-290xx/CVE-2024-29072.json
+86 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-29072",
"sourceIdentifier": "[email protected]",
"published": "2024-05-28T14:15:12.493",
"lastModified": "2024-11-21T09:07:29.887",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T16:03:32.227",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -51,22 +51,102 @@
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionEndIncluding": "11.2.9.53938",
"matchCriteriaId": "310F9865-EAB7-4537-B205-CE25418D5A3B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.0.0",
"versionEndIncluding": "12.1.6.15509",
"matchCriteriaId": "D3F78536-999B-4FAA-9F7D-C35621384E87"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "13.0.0",
"versionEndIncluding": "13.1.1.22432",
"matchCriteriaId": "BED878DD-2908-49CE-8248-1A950D9F750D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2023.1.0.15510",
"versionEndIncluding": "2023.3.0.23028",
"matchCriteriaId": "0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2024.1.0.23997",
"versionEndIncluding": "2024.2.1.25153",
"matchCriteriaId": "CEE05FE1-67A3-4AE1-B49B-3C497E7D944B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2024.2.1.25153",
"matchCriteriaId": "525AF74D-C7F7-466E-9501-60B489C7803F"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
}
]
}
]
}
],
"references": [
{
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1989",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1989",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1989",
"source": "af854a3a-2127-422b-91ae-364da2661108"
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1989",
"source": "af854a3a-2127-422b-91ae-364da2661108"
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
]
}
]
}
CVE-2024/CVE-2024-450xx/CVE-2024-45061.json
+49 -4
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-45061",
"sourceIdentifier": "[email protected]",
"published": "2025-01-15T15:15:11.730",
"lastModified": "2025-01-15T17:15:15.113",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T16:25:15.987",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -36,6 +36,26 @@
},
"exploitabilityScore": 2.3,
"impactScore": 5.8
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7
}
]
},
@@ -51,14 +71,39 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:observium:observium:24.4.13528:*:*:*:community:*:*:*",
"matchCriteriaId": "95117B86-A048-44B0-A349-F891B304A09E"
}
]
}
]
}
],
"references": [
{
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2092",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2092",
"source": "af854a3a-2127-422b-91ae-364da2661108"
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
]
}
]
}
CVE-2024/CVE-2024-470xx/CVE-2024-47002.json
+49 -4
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-47002",
"sourceIdentifier": "[email protected]",
"published": "2025-01-15T15:15:11.963",
"lastModified": "2025-01-15T17:15:15.883",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T16:22:31.360",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -36,6 +36,26 @@
},
"exploitabilityScore": 2.3,
"impactScore": 5.8
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7
}
]
},
@@ -51,14 +71,39 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:observium:observium:24.4.13528:*:*:*:community:*:*:*",
"matchCriteriaId": "95117B86-A048-44B0-A349-F891B304A09E"
}
]
}
]
}
],
"references": [
{
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2091",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2091",
"source": "af854a3a-2127-422b-91ae-364da2661108"
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
]
}
]
}
CVE-2024/CVE-2024-470xx/CVE-2024-47065.json
+47 -3
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-47065",
"sourceIdentifier": "[email protected]",
"published": "2025-07-11T17:15:31.167",
"lastModified": "2025-07-15T13:14:49.980",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T16:01:46.497",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -59,6 +59,28 @@
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 2.5
}
]
},
"weaknesses": [
@@ -73,10 +95,32 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:meshtastic:meshtastic_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.5.1",
"matchCriteriaId": "E439DDC9-06DB-4E86-A0E4-4D5FF73E9870"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/meshtastic/firmware/security/advisories/GHSA-4hjx-54gf-2jh7",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
}
]
}
CVE-2024/CVE-2024-471xx/CVE-2024-47140.json
+49 -4
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-47140",
"sourceIdentifier": "[email protected]",
"published": "2025-01-15T15:15:12.123",
"lastModified": "2025-01-15T17:15:15.997",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T16:19:46.550",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -36,6 +36,26 @@
},
"exploitabilityScore": 2.3,
"impactScore": 5.8
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7
}
]
},
@@ -51,14 +71,39 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:observium:observium:24.4.13528:*:*:*:community:*:*:*",
"matchCriteriaId": "95117B86-A048-44B0-A349-F891B304A09E"
}
]
}
]
}
],
"references": [
{
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2090",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2090",
"source": "af854a3a-2127-422b-91ae-364da2661108"
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
]
}
]
}
CVE-2024/CVE-2024-506xx/CVE-2024-50644.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2024-50644",
"sourceIdentifier": "[email protected]",
"published": "2025-08-22T17:15:31.640",
"lastModified": "2025-08-22T17:15:31.640",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "zhisheng17 blog 3.0.1-SNAPSHOT has an authentication bypass vulnerability. An attacker can exploit this vulnerability to access API without any token."
}
],
"metrics": {},
"references": [
{
"url": "https://gitee.com/fushuling/cve/blob/master/CVE-2024-50644.md",
"source": "[email protected]"
},
{
"url": "https://github.com/zhisheng17/blog",
"source": "[email protected]"
},
{
"url": "https://github.com/zhisheng17/blog/issues/64",
"source": "[email protected]"
}
]
}
CVE-2024/CVE-2024-525xx/CVE-2024-52599.json
+53 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2024-52599",
"sourceIdentifier": "[email protected]",
"published": "2024-12-09T19:15:13.863",
"lastModified": "2024-12-09T19:15:13.863",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T16:19:06.600",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -51,22 +51,69 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "16.0-7",
"matchCriteriaId": "F6A1C564-201D-43CA-BD24-E7DE7B2F8C2E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*",
"versionEndExcluding": "16.1.99.50",
"matchCriteriaId": "D6B1E987-E529-41F7-AE4E-83EEA8C7240B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "16.1",
"versionEndExcluding": "16.1-4",
"matchCriteriaId": "0163CCD1-23B5-4295-A36C-5621C4CA5C3B"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/Enalean/tuleap/commit/d3686ab152b6f64ff835e7dd3c99d97b36a9d4d5",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-489c-fm2j-qjw7",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"Patch"
]
},
{
"url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=d3686ab152b6f64ff835e7dd3c99d97b36a9d4d5",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Permissions Required"
]
},
{
"url": "https://tuleap.net/plugins/tracker/?aid=40459",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"Issue Tracking",
"Patch",
"Exploit"
]
}
]
}
CVE-2024/CVE-2024-534xx/CVE-2024-53494.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2024-53494",
"sourceIdentifier": "[email protected]",
"published": "2025-08-22T17:15:31.813",
"lastModified": "2025-08-22T17:15:31.813",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Incorrect access control in the preHandle function of SpringBootBlog v1.0.0 allows attackers to access sensitive components without authentication."
}
],
"metrics": {},
"references": [
{
"url": "https://gitee.com/fushuling/cve/blob/master/CVE-2024-53494.md",
"source": "[email protected]"
},
{
"url": "https://github.com/caozongpeng/SpringBootBlog/issues/23",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-03xx/CVE-2025-0333.json
+72 -7
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-0333",
"sourceIdentifier": "[email protected]",
"published": "2025-01-09T05:15:08.453",
"lastModified": "2025-01-09T17:15:18.077",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T16:41:07.243",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -80,6 +80,26 @@
},
"exploitabilityScore": 2.8,
"impactScore": 3.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"cvssMetricV2": [
@@ -122,28 +142,73 @@
"value": "CWE-89"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:leiyuxi:cy-fast:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9FEF83C3-4D95-4EFB-82E1-96FC50BC0E3B"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/d3do-23/cvelist/blob/main/cy-fast/sqli1.md",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit"
]
},
{
"url": "https://vuldb.com/?ctiid.290820",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Permissions Required",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?id.290820",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?submit.475297",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://github.com/d3do-23/cvelist/blob/main/cy-fast/sqli1.md",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit"
]
}
]
}
CVE-2025/CVE-2025-03xx/CVE-2025-0334.json
+68 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-0334",
"sourceIdentifier": "[email protected]",
"published": "2025-01-09T06:15:15.610",
"lastModified": "2025-01-09T06:15:15.610",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T16:35:17.467",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -80,6 +80,26 @@
},
"exploitabilityScore": 2.8,
"impactScore": 3.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"cvssMetricV2": [
@@ -122,24 +142,66 @@
"value": "CWE-89"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:leiyuxi:cy-fast:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9FEF83C3-4D95-4EFB-82E1-96FC50BC0E3B"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/d3do-23/cvelist/blob/main/cy-fast/sqli2.md",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit"
]
},
{
"url": "https://vuldb.com/?ctiid.290821",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Permissions Required",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?id.290821",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?submit.475302",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
}
]
}
CVE-2025/CVE-2025-03xx/CVE-2025-0344.json
+69 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-0344",
"sourceIdentifier": "[email protected]",
"published": "2025-01-09T08:15:30.517",
"lastModified": "2025-01-09T08:15:30.517",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T16:32:49.497",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -80,6 +80,26 @@
},
"exploitabilityScore": 2.8,
"impactScore": 3.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"cvssMetricV2": [
@@ -122,24 +142,67 @@
"value": "CWE-89"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:leiyuxi:cy-fast:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9FEF83C3-4D95-4EFB-82E1-96FC50BC0E3B"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/d3do-23/cvelist/blob/main/cy-fast/sqli3.md",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://vuldb.com/?ctiid.290857",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Permissions Required",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?id.290857",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?submit.475747",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
}
]
}
CVE-2025/CVE-2025-03xx/CVE-2025-0345.json
+68 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-0345",
"sourceIdentifier": "[email protected]",
"published": "2025-01-09T09:15:09.220",
"lastModified": "2025-01-09T09:15:09.220",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T16:28:28.197",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -80,6 +80,26 @@
},
"exploitabilityScore": 2.8,
"impactScore": 3.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"cvssMetricV2": [
@@ -122,24 +142,66 @@
"value": "CWE-89"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:leiyuxi:cy-fast:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9FEF83C3-4D95-4EFB-82E1-96FC50BC0E3B"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/d3do-23/cvelist/blob/main/cy-fast/sqli4.md",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit"
]
},
{
"url": "https://vuldb.com/?ctiid.290858",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Permissions Required",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?id.290858",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/?submit.475748",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
}
]
}
CVE-2025/CVE-2025-221xx/CVE-2025-22129.json
+56 -6
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-22129",
"sourceIdentifier": "[email protected]",
"published": "2025-02-03T22:15:28.040",
"lastModified": "2025-02-04T19:15:33.360",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T16:19:54.547",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -51,22 +51,72 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "16.2-5",
"matchCriteriaId": "41FE2568-290E-4F8B-A68A-9DB729C3AEEE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*",
"versionEndExcluding": "16.3.99.1736242932",
"matchCriteriaId": "DFA88343-F810-4A5C-8E92-6A254B7B88A0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "16.3",
"versionEndExcluding": "16.3-2",
"matchCriteriaId": "9D9BF98E-1188-4BB7-865E-0836EBD2E60C"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-f34g-wc2m-mf76",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"Patch"
]
},
{
"url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=3edf8158ba40be66f0b661888b8b2805784795d1",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Permissions Required"
]
},
{
"url": "https://tuleap.net/plugins/tracker/?aid=41434",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Vendor Advisory",
"Exploit",
"Issue Tracking",
"Patch"
]
},
{
"url": "https://tuleap.net/plugins/tracker/?aid=41434",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Vendor Advisory",
"Exploit",
"Issue Tracking",
"Patch"
]
}
]
}
CVE-2025/CVE-2025-247xx/CVE-2025-24798.json
+54 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-24798",
"sourceIdentifier": "[email protected]",
"published": "2025-07-10T22:15:24.387",
"lastModified": "2025-07-15T13:14:49.980",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T16:02:31.793",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -36,6 +36,26 @@
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
]
},
@@ -51,18 +71,47 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:meshtastic:meshtastic_firmware:*:*:*:*:*:*:*:*",
"versionStartIncluding": "1.2.1",
"versionEndExcluding": "2.6.2",
"matchCriteriaId": "80418279-3324-462A-ACDE-87C2D3BB35DD"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/meshtastic/firmware/blob/cdcbf4c61550e45c125e17a20aff4275e9389655/src/modules/RoutingModule.cpp#L44-L48",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Product"
]
},
{
"url": "https://github.com/meshtastic/firmware/commit/dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/meshtastic/firmware/security/advisories/GHSA-4q84-546j-3mf5",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
}
]
}
CVE-2025/CVE-2025-273xx/CVE-2025-27397.json
+36 -3
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-27397",
"sourceIdentifier": "[email protected]",
"published": "2025-03-11T10:15:19.083",
"lastModified": "2025-03-11T10:15:19.083",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T17:58:09.643",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -95,10 +95,43 @@
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:siemens:scalance_lpe9403_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0",
"matchCriteriaId": "1F8FD0DA-AB97-43DC-A9FB-DEFB7804036B"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:siemens:scalance_lpe9403:-:*:*:*:*:*:*:*",
"matchCriteriaId": "52A77C9D-E59C-4397-B834-797D7B334A6B"
}
]
}
]
}
],
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-075201.html",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}
CVE-2025/CVE-2025-273xx/CVE-2025-27398.json
+36 -3
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-27398",
"sourceIdentifier": "[email protected]",
"published": "2025-03-11T10:15:19.247",
"lastModified": "2025-03-11T10:15:19.247",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T17:51:58.517",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -95,10 +95,43 @@
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:siemens:scalance_lpe9403_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0",
"matchCriteriaId": "1F8FD0DA-AB97-43DC-A9FB-DEFB7804036B"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:siemens:scalance_lpe9403:-:*:*:*:*:*:*:*",
"matchCriteriaId": "52A77C9D-E59C-4397-B834-797D7B334A6B"
}
]
}
]
}
],
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-075201.html",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}
CVE-2025/CVE-2025-274xx/CVE-2025-27401.json
+49 -5
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-27401",
"sourceIdentifier": "[email protected]",
"published": "2025-03-04T17:15:19.547",
"lastModified": "2025-03-04T17:15:19.547",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T16:00:59.597",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -51,18 +51,62 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "16.3-11",
"matchCriteriaId": "44FFF09C-980B-4D7E-AF34-BBAECB1B179D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*",
"versionEndExcluding": "16.4.99.1740498975",
"matchCriteriaId": "5609916B-3E6B-4009-8837-701EF159FF6F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "16.4",
"versionEndExcluding": "16.4-6",
"matchCriteriaId": "54A72640-277F-4E54-A2F4-8948FF0F16E2"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/Enalean/tuleap/commit/0070fef5c3b27fd402d3232041c6e03f79a84ffd",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-3rjf-87rf-h8m9",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"Patch"
]
},
{
"url": "https://tuleap.net/plugins/tracker/?aid=41850",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Vendor Advisory",
"Exploit",
"Issue Tracking",
"Patch"
]
}
]
}
CVE-2025/CVE-2025-274xx/CVE-2025-27493.json
+85 -4
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-27493",
"sourceIdentifier": "[email protected]",
"published": "2025-03-11T10:15:19.577",
"lastModified": "2025-03-11T10:15:19.577",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T17:50:58.940",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -63,7 +63,7 @@
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
@@ -80,6 +80,26 @@
},
"exploitabilityScore": 1.5,
"impactScore": 6.0
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 0.8,
"impactScore": 5.9
}
]
},
@@ -95,10 +115,71 @@
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:siemens:sipass_integrated_ac5102_\\(acc-g2\\)_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.9",
"matchCriteriaId": "E417E572-D776-4664-9BBB-06579C14A9D9"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:siemens:sipass_integrated_ac5102_\\(acc-g2\\):-:*:*:*:*:*:*:*",
"matchCriteriaId": "0691F0D6-FC6C-41FC-8601-393AECB1E6E9"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:siemens:sipass_integrated_acc-ap_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.9",
"matchCriteriaId": "F867548F-CC8D-4B1F-87C3-9138DCB7F6E3"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:siemens:sipass_integrated_acc-ap:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7E714A08-D557-4F6F-B089-89E3FFB7105A"
}
]
}
]
}
],
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-515903.html",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}
CVE-2025/CVE-2025-274xx/CVE-2025-27494.json
+95 -4
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-27494",
"sourceIdentifier": "[email protected]",
"published": "2025-03-11T10:15:19.783",
"lastModified": "2025-03-11T10:15:19.783",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T17:49:43.953",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -63,7 +63,7 @@
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
@@ -80,6 +80,26 @@
},
"exploitabilityScore": 2.3,
"impactScore": 6.0
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9
}
]
},
@@ -93,12 +113,83 @@
"value": "CWE-20"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:siemens:sipass_integrated_ac5102_\\(acc-g2\\)_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.9",
"matchCriteriaId": "E417E572-D776-4664-9BBB-06579C14A9D9"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:siemens:sipass_integrated_ac5102_\\(acc-g2\\):-:*:*:*:*:*:*:*",
"matchCriteriaId": "0691F0D6-FC6C-41FC-8601-393AECB1E6E9"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:siemens:sipass_integrated_acc-ap_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.9",
"matchCriteriaId": "F867548F-CC8D-4B1F-87C3-9138DCB7F6E3"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:siemens:sipass_integrated_acc-ap:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7E714A08-D557-4F6F-B089-89E3FFB7105A"
}
]
}
]
}
],
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-515903.html",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}
CVE-2025/CVE-2025-274xx/CVE-2025-27496.json
+29 -4
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-27496",
"sourceIdentifier": "[email protected]",
"published": "2025-03-13T19:15:52.050",
"lastModified": "2025-03-13T19:15:52.050",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T17:42:18.167",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -51,14 +51,39 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:snowflake:snowflake_jdbc:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.0.13",
"versionEndExcluding": "3.23.1",
"matchCriteriaId": "940CB581-6281-4238-9A49-CFEC2FC946B3"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/snowflakedb/snowflake-jdbc/commit/ef81582ce2f1dbc3c8794a696c94f4fe65fad507",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/snowflakedb/snowflake-jdbc/security/advisories/GHSA-q298-375f-5q63",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}
CVE-2025/CVE-2025-293xx/CVE-2025-29365.json
+72
View File
@@ -0,0 +1,72 @@
{
"id": "CVE-2025-29365",
"sourceIdentifier": "[email protected]",
"published": "2025-08-22T16:15:34.797",
"lastModified": "2025-08-22T16:15:34.797",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in READ_STRING_SYSCALL."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-120"
},
{
"lang": "en",
"value": "CWE-125"
},
{
"lang": "en",
"value": "CWE-274"
},
{
"lang": "en",
"value": "CWE-787"
}
]
}
],
"references": [
{
"url": "https://gist.github.com/Giles-one/3a80cd1c7014e50601bd1c0dd9d41663",
"source": "[email protected]"
},
{
"url": "https://github.com/Giles-one/spimsimulatorEscape?tab=readme-ov-file#bug1-out-of-bounds-write-in-read_input-function",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-293xx/CVE-2025-29366.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2025-29366",
"sourceIdentifier": "[email protected]",
"published": "2025-08-22T16:15:35.030",
"lastModified": "2025-08-22T16:15:35.030",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In mupen64plus v2.6.0 there is an array overflow vulnerability in the write_rdram_regs and write_rdram_regs functions, which enables executing arbitrary commands on the host machine."
}
],
"metrics": {},
"references": [
{
"url": "https://gist.github.com/Giles-one/f4ea405c2a26000bb4ff4cfb9622be49",
"source": "[email protected]"
},
{
"url": "https://github.com/Giles-one/mupen64plusEscape/tree/main/BUG1",
"source": "[email protected]"
},
{
"url": "https://github.com/mupen64plus/mupen64plus-core/blob/2.6.0/src/device/rdram/rdram.c#L159",
"source": "[email protected]"
},
{
"url": "https://github.com/mupen64plus/mupen64plus-core/blob/master/src/device/rdram/rdram.h#L50",
"source": "[email protected]"
},
{
"url": "https://github.com/mupen64plus/mupen64plus-core/blob/master/src/device/rdram/rdram.h#L60",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-359xx/CVE-2025-35966.json
+29 -4
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-35966",
"sourceIdentifier": "[email protected]",
"published": "2025-07-22T16:15:26.913",
"lastModified": "2025-07-25T15:29:44.523",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T16:16:02.100",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -51,14 +51,39 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:bloomberg:comdb2:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B7BA78E-2D63-4122-BD8D-B3BBCD719556"
}
]
}
]
}
],
"references": [
{
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2201",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"Exploit"
]
},
{
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2201",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Third Party Advisory",
"Exploit"
]
}
]
}
CVE-2025/CVE-2025-365xx/CVE-2025-36512.json
+29 -4
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-36512",
"sourceIdentifier": "[email protected]",
"published": "2025-07-22T16:15:27.117",
"lastModified": "2025-07-25T15:29:44.523",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T16:18:21.207",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -51,14 +51,39 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:bloomberg:comdb2:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B7BA78E-2D63-4122-BD8D-B3BBCD719556"
}
]
}
]
}
],
"references": [
{
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2200",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2200",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Third Party Advisory"
]
}
]
}
CVE-2025/CVE-2025-365xx/CVE-2025-36520.json
+29 -4
View File
@@ -2,8 +2,8 @@
"id": "CVE-2025-36520",
"sourceIdentifier": "[email protected]",
"published": "2025-07-22T16:15:27.320",
"lastModified": "2025-07-25T15:29:44.523",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2025-08-22T16:18:09.797",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@@ -51,14 +51,39 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:bloomberg:comdb2:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B7BA78E-2D63-4122-BD8D-B3BBCD719556"
}
]
}
]
}
],
"references": [
{
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2197",
"source": "[email protected]"
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2197",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Third Party Advisory"
]
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38619.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2025-38619",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:35.177",
"lastModified": "2025-08-22T16:15:35.177",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ti: j721e-csi2rx: fix list_del corruption\n\nIf ti_csi2rx_start_dma() fails in ti_csi2rx_dma_callback(), the buffer is\nmarked done with VB2_BUF_STATE_ERROR but is not removed from the DMA queue.\nThis causes the same buffer to be retried in the next iteration, resulting\nin a double list_del() and eventual list corruption.\n\nFix this by removing the buffer from the queue before calling\nvb2_buffer_done() on error.\n\nThis resolves a crash due to list_del corruption:\n[ 37.811243] j721e-csi2rx 30102000.ticsi2rx: Failed to queue the next buffer for DMA\n[ 37.832187] slab kmalloc-2k start ffff00000255b000 pointer offset 1064 size 2048\n[ 37.839761] list_del corruption. next->prev should be ffff00000255bc28, but was ffff00000255d428. (next=ffff00000255b428)\n[ 37.850799] ------------[ cut here ]------------\n[ 37.855424] kernel BUG at lib/list_debug.c:65!\n[ 37.859876] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP\n[ 37.866061] Modules linked in: i2c_dev usb_f_rndis u_ether libcomposite dwc3 udc_core usb_common aes_ce_blk aes_ce_cipher ghash_ce gf128mul sha1_ce cpufreq_dt dwc3_am62 phy_gmii_sel sa2ul\n[ 37.882830] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.16.0-rc3+ #28 VOLUNTARY\n[ 37.890851] Hardware name: Bosch STLA-GSRV2-B0 (DT)\n[ 37.895737] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 37.902703] pc : __list_del_entry_valid_or_report+0xdc/0x114\n[ 37.908390] lr : __list_del_entry_valid_or_report+0xdc/0x114\n[ 37.914059] sp : ffff800080003db0\n[ 37.917375] x29: ffff800080003db0 x28: 0000000000000007 x27: ffff800080e50000\n[ 37.924521] x26: 0000000000000000 x25: ffff0000016abb50 x24: dead000000000122\n[ 37.931666] x23: ffff0000016abb78 x22: ffff0000016ab080 x21: ffff800080003de0\n[ 37.938810] x20: ffff00000255bc00 x19: ffff00000255b800 x18: 000000000000000a\n[ 37.945956] x17: 20747562202c3832 x16: 6362353532303030 x15: 0720072007200720\n[ 37.953101] x14: 0720072007200720 x13: 0720072007200720 x12: 00000000ffffffea\n[ 37.960248] x11: ffff800080003b18 x10: 00000000ffffefff x9 : ffff800080f5b568\n[ 37.967396] x8 : ffff800080f5b5c0 x7 : 0000000000017fe8 x6 : c0000000ffffefff\n[ 37.974542] x5 : ffff00000fea6688 x4 : 0000000000000000 x3 : 0000000000000000\n[ 37.981686] x2 : 0000000000000000 x1 : ffff800080ef2b40 x0 : 000000000000006d\n[ 37.988832] Call trace:\n[ 37.991281] __list_del_entry_valid_or_report+0xdc/0x114 (P)\n[ 37.996959] ti_csi2rx_dma_callback+0x84/0x1c4\n[ 38.001419] udma_vchan_complete+0x1e0/0x344\n[ 38.005705] tasklet_action_common+0x118/0x310\n[ 38.010163] tasklet_action+0x30/0x3c\n[ 38.013832] handle_softirqs+0x10c/0x2e0\n[ 38.017761] __do_softirq+0x14/0x20\n[ 38.021256] ____do_softirq+0x10/0x20\n[ 38.024931] call_on_irq_stack+0x24/0x60\n[ 38.028873] do_softirq_own_stack+0x1c/0x40\n[ 38.033064] __irq_exit_rcu+0x130/0x15c\n[ 38.036909] irq_exit_rcu+0x10/0x20\n[ 38.040403] el1_interrupt+0x38/0x60\n[ 38.043987] el1h_64_irq_handler+0x18/0x24\n[ 38.048091] el1h_64_irq+0x6c/0x70\n[ 38.051501] default_idle_call+0x34/0xe0 (P)\n[ 38.055783] do_idle+0x1f8/0x250\n[ 38.059021] cpu_startup_entry+0x34/0x3c\n[ 38.062951] rest_init+0xb4/0xc0\n[ 38.066186] console_on_rootfs+0x0/0x6c\n[ 38.070031] __primary_switched+0x88/0x90\n[ 38.074059] Code: b00037e0 91378000 f9400462 97e9bf49 (d4210000)\n[ 38.080168] ---[ end trace 0000000000000000 ]---\n[ 38.084795] Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt\n[ 38.092197] SMP: stopping secondary CPUs\n[ 38.096139] Kernel Offset: disabled\n[ 38.099631] CPU features: 0x0000,00002000,02000801,0400420b\n[ 38.105202] Memory Limit: none\n[ 38.108260] ---[ end Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt ]---"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/68e5579f4de12207b23c41b44a4c0778b6c2858f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/92d0188f36ca8082af7989d743eb5b44c2d259f7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a4a8cb0889927d59ebd839458c8f038bc5298ef9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ae42c6fe531425ef2f47e82f96851427d24bbf6b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38620.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2025-38620",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:35.320",
"lastModified": "2025-08-22T16:15:35.320",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nzloop: fix KASAN use-after-free of tag set\n\nWhen a zoned loop device, or zloop device, is removed, KASAN enabled\nkernel reports \"BUG KASAN use-after-free\" in blk_mq_free_tag_set(). The\nBUG happens because zloop_ctl_remove() calls put_disk(), which invokes\nzloop_free_disk(). The zloop_free_disk() frees the memory allocated for\nthe zlo pointer. However, after the memory is freed, zloop_ctl_remove()\ncalls blk_mq_free_tag_set(&zlo->tag_set), which accesses the freed zlo.\nHence the KASAN use-after-free.\n\n zloop_ctl_remove()\n put_disk(zlo->disk)\n put_device()\n kobject_put()\n ...\n zloop_free_disk()\n kvfree(zlo)\n blk_mq_free_tag_set(&zlo->tag_set)\n\nTo avoid the BUG, move the call to blk_mq_free_tag_set(&zlo->tag_set)\nfrom zloop_ctl_remove() into zloop_free_disk(). This ensures that\nthe tag_set is freed before the call to kvfree(zlo)."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/765761851d89c772f482494d452e266795460278",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c7c87046b41a9ef28ee7ac476c369da5b5228bc5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38621.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2025-38621",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:35.460",
"lastModified": "2025-08-22T16:15:35.460",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: make rdev_addable usable for rcu mode\n\nOur testcase trigger panic:\n\nBUG: kernel NULL pointer dereference, address: 00000000000000e0\n...\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 2 UID: 0 PID: 85 Comm: kworker/2:1 Not tainted 6.16.0+ #94\nPREEMPT(none)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.1-2.fc37 04/01/2014\nWorkqueue: md_misc md_start_sync\nRIP: 0010:rdev_addable+0x4d/0xf0\n...\nCall Trace:\n <TASK>\n md_start_sync+0x329/0x480\n process_one_work+0x226/0x6d0\n worker_thread+0x19e/0x340\n kthread+0x10f/0x250\n ret_from_fork+0x14d/0x180\n ret_from_fork_asm+0x1a/0x30\n </TASK>\nModules linked in: raid10\nCR2: 00000000000000e0\n---[ end trace 0000000000000000 ]---\nRIP: 0010:rdev_addable+0x4d/0xf0\n\nmd_spares_need_change in md_start_sync will call rdev_addable which\nprotected by rcu_read_lock/rcu_read_unlock. This rcu context will help\nprotect rdev won't be released, but rdev->mddev will be set to NULL\nbefore we call synchronize_rcu in md_kick_rdev_from_array. Fix this by\nusing READ_ONCE and check does rdev->mddev still alive."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/13017b427118f4311471ee47df74872372ca8482",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b5fbe940862339cdcc34dea7a057ad18d18fa137",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38622.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2025-38622",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:35.603",
"lastModified": "2025-08-22T16:15:35.603",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: drop UFO packets in udp_rcv_segment()\n\nWhen sending a packet with virtio_net_hdr to tun device, if the gso_type\nin virtio_net_hdr is SKB_GSO_UDP and the gso_size is less than udphdr\nsize, below crash may happen.\n\n ------------[ cut here ]------------\n kernel BUG at net/core/skbuff.c:4572!\n Oops: invalid opcode: 0000 [#1] SMP NOPTI\n CPU: 0 UID: 0 PID: 62 Comm: mytest Not tainted 6.16.0-rc7 #203 PREEMPT(voluntary)\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n RIP: 0010:skb_pull_rcsum+0x8e/0xa0\n Code: 00 00 5b c3 cc cc cc cc 8b 93 88 00 00 00 f7 da e8 37 44 38 00 f7 d8 89 83 88 00 00 00 48 8b 83 c8 00 00 00 5b c3 cc cc cc cc <0f> 0b 0f 0b 66 66 2e 0f 1f 84 00 000\n RSP: 0018:ffffc900001fba38 EFLAGS: 00000297\n RAX: 0000000000000004 RBX: ffff8880040c1000 RCX: ffffc900001fb948\n RDX: ffff888003e6d700 RSI: 0000000000000008 RDI: ffff88800411a062\n RBP: ffff8880040c1000 R08: 0000000000000000 R09: 0000000000000001\n R10: ffff888003606c00 R11: 0000000000000001 R12: 0000000000000000\n R13: ffff888004060900 R14: ffff888004050000 R15: ffff888004060900\n FS: 000000002406d3c0(0000) GS:ffff888084a19000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000020000040 CR3: 0000000004007000 CR4: 00000000000006f0\n Call Trace:\n <TASK>\n udp_queue_rcv_one_skb+0x176/0x4b0 net/ipv4/udp.c:2445\n udp_queue_rcv_skb+0x155/0x1f0 net/ipv4/udp.c:2475\n udp_unicast_rcv_skb+0x71/0x90 net/ipv4/udp.c:2626\n __udp4_lib_rcv+0x433/0xb00 net/ipv4/udp.c:2690\n ip_protocol_deliver_rcu+0xa6/0x160 net/ipv4/ip_input.c:205\n ip_local_deliver_finish+0x72/0x90 net/ipv4/ip_input.c:233\n ip_sublist_rcv_finish+0x5f/0x70 net/ipv4/ip_input.c:579\n ip_sublist_rcv+0x122/0x1b0 net/ipv4/ip_input.c:636\n ip_list_rcv+0xf7/0x130 net/ipv4/ip_input.c:670\n __netif_receive_skb_list_core+0x21d/0x240 net/core/dev.c:6067\n netif_receive_skb_list_internal+0x186/0x2b0 net/core/dev.c:6210\n napi_complete_done+0x78/0x180 net/core/dev.c:6580\n tun_get_user+0xa63/0x1120 drivers/net/tun.c:1909\n tun_chr_write_iter+0x65/0xb0 drivers/net/tun.c:1984\n vfs_write+0x300/0x420 fs/read_write.c:593\n ksys_write+0x60/0xd0 fs/read_write.c:686\n do_syscall_64+0x50/0x1c0 arch/x86/entry/syscall_64.c:63\n </TASK>\n\nTo trigger gso segment in udp_queue_rcv_skb(), we should also set option\nUDP_ENCAP_ESPINUDP to enable udp_sk(sk)->encap_rcv. When the encap_rcv\nhook return 1 in udp_queue_rcv_one_skb(), udp_csum_pull_header() will try\nto pull udphdr, but the skb size has been segmented to gso size, which\nleads to this crash.\n\nPrevious commit cf329aa42b66 (\"udp: cope with UDP GRO packet misdirection\")\nintroduces segmentation in UDP receive path only for GRO, which was never\nintended to be used for UFO, so drop UFO packets in udp_rcv_segment()."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0c639c6479ec4480372901a5fc566f7588cf5522",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/0d45954034f8edd6d4052e0190d3d6335c37e4de",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/791f32c5eab33ca3a153f8f6f763aa0df1ddc320",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c0ec2e47f1e92d69b42b17a4a1e543256778393e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d46e51f1c78b9ab9323610feb14238d06d46d519",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fc45b3f9599b657d4a64bcf423d2a977b3e13a49",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38623.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2025-38623",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:35.760",
"lastModified": "2025-08-22T16:15:35.760",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: pnv_php: Fix surprise plug detection and recovery\n\nThe existing PowerNV hotplug code did not handle surprise plug events\ncorrectly, leading to a complete failure of the hotplug system after device\nremoval and a required reboot to detect new devices.\n\nThis comes down to two issues:\n\n 1) When a device is surprise removed, often the bridge upstream\n port will cause a PE freeze on the PHB. If this freeze is not\n cleared, the MSI interrupts from the bridge hotplug notification\n logic will not be received by the kernel, stalling all plug events\n on all slots associated with the PE.\n\n 2) When a device is removed from a slot, regardless of surprise or\n programmatic removal, the associated PHB/PE ls left frozen.\n If this freeze is not cleared via a fundamental reset, skiboot\n is unable to clear the freeze and cannot retrain / rescan the\n slot. This also requires a reboot to clear the freeze and redetect\n the device in the slot.\n\nIssue the appropriate unfreeze and rescan commands on hotplug events,\nand don't oops on hotplug if pci_bus_to_OF_node() returns NULL.\n\n[bhelgaas: tidy comments]"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1d2f63680c5719a5da92639e981c6c9a87fcee08",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/473999ba937eac9776be791deed7c84a21d7880b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/48c6935a34981bb56f35be0774ec1f30c6e386f8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6e7b24c71e530a6c1d656e73d8a30ee081656844",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/78d20b8c13075eae3d884c21db7a09a6bbdda5b2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a2a2a6fc2469524caa713036297c542746d148dc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38624.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2025-38624",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:35.910",
"lastModified": "2025-08-22T16:15:35.910",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: pnv_php: Clean up allocated IRQs on unplug\n\nWhen the root of a nested PCIe bridge configuration is unplugged, the\npnv_php driver leaked the allocated IRQ resources for the child bridges'\nhotplug event notifications, resulting in a panic.\n\nFix this by walking all child buses and deallocating all its IRQ resources\nbefore calling pci_hp_remove_devices().\n\nAlso modify the lifetime of the workqueue at struct pnv_php_slot::wq so\nthat it is only destroyed in pnv_php_free_slot(), instead of\npnv_php_disable_irq(). This is required since pnv_php_disable_irq() will\nnow be called by workers triggered by hot unplug interrupts, so the\nworkqueue needs to stay allocated.\n\nThe abridged kernel panic that occurs without this patch is as follows:\n\n WARNING: CPU: 0 PID: 687 at kernel/irq/msi.c:292 msi_device_data_release+0x6c/0x9c\n CPU: 0 UID: 0 PID: 687 Comm: bash Not tainted 6.14.0-rc5+ #2\n Call Trace:\n msi_device_data_release+0x34/0x9c (unreliable)\n release_nodes+0x64/0x13c\n devres_release_all+0xc0/0x140\n device_del+0x2d4/0x46c\n pci_destroy_dev+0x5c/0x194\n pci_hp_remove_devices+0x90/0x128\n pci_hp_remove_devices+0x44/0x128\n pnv_php_disable_slot+0x54/0xd4\n power_write_file+0xf8/0x18c\n pci_slot_attr_store+0x40/0x5c\n sysfs_kf_write+0x64/0x78\n kernfs_fop_write_iter+0x1b0/0x290\n vfs_write+0x3bc/0x50c\n ksys_write+0x84/0x140\n system_call_exception+0x124/0x230\n system_call_vectored_common+0x15c/0x2ec\n\n[bhelgaas: tidy comments]"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1773c19fa55e944cdd2634e2d9e552f87f2d38d5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/28aa3cfce12487614219e7667ec84424e1f43227",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/32173edf3fe2d447e14e5e3b299387c6f9602a88",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/398170b7fd0e0db2f8096df5206c75e5ff41415a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4668619092554e1b95c9a5ac2941ca47ba6d548a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bbd302c4b79df10197ffa7270ca3aa572eeca33c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38625.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2025-38625",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:36.057",
"lastModified": "2025-08-22T16:15:36.057",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pds: Fix missing detach_ioas op\n\nWhen CONFIG_IOMMUFD is enabled and a device is bound to the pds_vfio_pci\ndriver, the following WARN_ON() trace is seen and probe fails:\n\nWARNING: CPU: 0 PID: 5040 at drivers/vfio/vfio_main.c:317 __vfio_register_dev+0x130/0x140 [vfio]\n<...>\npds_vfio_pci 0000:08:00.1: probe with driver pds_vfio_pci failed with error -22\n\nThis is because the driver's vfio_device_ops.detach_ioas isn't set.\n\nFix this by using the generic vfio_iommufd_physical_detach_ioas\nfunction."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1df8150ab4cc422bddfbd312d6758c50b688a971",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7dbfae90c5a33f6b694e7068bc9522cc2655373d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/88b962fbd0ac30a65d2869c68d2f145be46ebe4d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b265dff9fcf047f660976a5c92c83e7c414a2d95",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fe24d5bc635e103a517ec201c3cb571eeab8be2f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38626.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2025-38626",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:36.193",
"lastModified": "2025-08-22T16:15:36.193",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode\n\nw/ \"mode=lfs\" mount option, generic/299 will cause system panic as below:\n\n------------[ cut here ]------------\nkernel BUG at fs/f2fs/segment.c:2835!\nCall Trace:\n <TASK>\n f2fs_allocate_data_block+0x6f4/0xc50\n f2fs_map_blocks+0x970/0x1550\n f2fs_iomap_begin+0xb2/0x1e0\n iomap_iter+0x1d6/0x430\n __iomap_dio_rw+0x208/0x9a0\n f2fs_file_write_iter+0x6b3/0xfa0\n aio_write+0x15d/0x2e0\n io_submit_one+0x55e/0xab0\n __x64_sys_io_submit+0xa5/0x230\n do_syscall_64+0x84/0x2f0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0010:new_curseg+0x70f/0x720\n\nThe root cause of we run out-of-space is: in f2fs_map_blocks(), f2fs may\ntrigger foreground gc only if it allocates any physical block, it will be\na little bit later when there is multiple threads writing data w/\naio/dio/bufio method in parallel, since we always use OPU in lfs mode, so\nf2fs_map_blocks() does block allocations aggressively.\n\nIn order to fix this issue, let's give a chance to trigger foreground\ngc in prior to block allocation in f2fs_map_blocks()."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1005a3ca28e90c7a64fa43023f866b960a60f791",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/264ede8a52f18647ed5bb5f2bd9bf54f556ad8f5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/385e64a0744584397b4b52b27c96703516f39968",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/82765ce5c7a56f9309ee45328e763610eaf11253",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f289690f50a01c3e085d87853392d5b7436a4cee",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38627.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2025-38627",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:36.337",
"lastModified": "2025-08-22T16:15:36.337",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic\n\nThe decompress_io_ctx may be released asynchronously after\nI/O completion. If this file is deleted immediately after read,\nand the kworker of processing post_read_wq has not been executed yet\ndue to high workloads, It is possible that the inode(f2fs_inode_info)\nis evicted and freed before it is used f2fs_free_dic.\n\n The UAF case as below:\n Thread A Thread B\n - f2fs_decompress_end_io\n - f2fs_put_dic\n - queue_work\n add free_dic work to post_read_wq\n - do_unlink\n - iput\n - evict\n - call_rcu\n This file is deleted after read.\n\n Thread C kworker to process post_read_wq\n - rcu_do_batch\n - f2fs_free_inode\n - kmem_cache_free\n inode is freed by rcu\n - process_scheduled_works\n - f2fs_late_free_dic\n - f2fs_free_dic\n - f2fs_release_decomp_mem\n read (dic->inode)->i_compress_algorithm\n\nThis patch store compress_algorithm and sbi in dic to avoid inode UAF.\n\nIn addition, the previous solution is deprecated in [1] may cause system hang.\n[1] https://lore.kernel.org/all/[email protected]"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/39868685c2a94a70762bc6d77dc81d781d05bff5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8fae5b6addd5f6895e03797b56e3c7b9f9cd15c9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38628.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2025-38628",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:36.470",
"lastModified": "2025-08-22T16:15:36.470",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa/mlx5: Fix release of uninitialized resources on error path\n\nThe commit in the fixes tag made sure that mlx5_vdpa_free()\nis the single entrypoint for removing the vdpa device resources\nadded in mlx5_vdpa_dev_add(), even in the cleanup path of\nmlx5_vdpa_dev_add().\n\nThis means that all functions from mlx5_vdpa_free() should be able to\nhandle uninitialized resources. This was not the case though:\nmlx5_vdpa_destroy_mr_resources() and mlx5_cmd_cleanup_async_ctx()\nwere not able to do so. This caused the splat below when adding\na vdpa device without a MAC address.\n\nThis patch fixes these remaining issues:\n\n- Makes mlx5_vdpa_destroy_mr_resources() return early if called on\n uninitialized resources.\n\n- Moves mlx5_cmd_init_async_ctx() early on during device addition\n because it can't fail. This means that mlx5_cmd_cleanup_async_ctx()\n also can't fail. To mirror this, move the call site of\n mlx5_cmd_cleanup_async_ctx() in mlx5_vdpa_free().\n\nAn additional comment was added in mlx5_vdpa_free() to document\nthe expectations of functions called from this context.\n\nSplat:\n\n mlx5_core 0000:b5:03.2: mlx5_vdpa_dev_add:3950:(pid 2306) warning: No mac address provisioned?\n ------------[ cut here ]------------\n WARNING: CPU: 13 PID: 2306 at kernel/workqueue.c:4207 __flush_work+0x9a/0xb0\n [...]\n Call Trace:\n <TASK>\n ? __try_to_del_timer_sync+0x61/0x90\n ? __timer_delete_sync+0x2b/0x40\n mlx5_vdpa_destroy_mr_resources+0x1c/0x40 [mlx5_vdpa]\n mlx5_vdpa_free+0x45/0x160 [mlx5_vdpa]\n vdpa_release_dev+0x1e/0x50 [vdpa]\n device_release+0x31/0x90\n kobject_cleanup+0x37/0x130\n mlx5_vdpa_dev_add+0x327/0x890 [mlx5_vdpa]\n vdpa_nl_cmd_dev_add_set_doit+0x2c1/0x4d0 [vdpa]\n genl_family_rcv_msg_doit+0xd8/0x130\n genl_family_rcv_msg+0x14b/0x220\n ? __pfx_vdpa_nl_cmd_dev_add_set_doit+0x10/0x10 [vdpa]\n genl_rcv_msg+0x47/0xa0\n ? __pfx_genl_rcv_msg+0x10/0x10\n netlink_rcv_skb+0x53/0x100\n genl_rcv+0x24/0x40\n netlink_unicast+0x27b/0x3b0\n netlink_sendmsg+0x1f7/0x430\n __sys_sendto+0x1fa/0x210\n ? ___pte_offset_map+0x17/0x160\n ? next_uptodate_folio+0x85/0x2b0\n ? percpu_counter_add_batch+0x51/0x90\n ? filemap_map_pages+0x515/0x660\n __x64_sys_sendto+0x20/0x30\n do_syscall_64+0x7b/0x2c0\n ? do_read_fault+0x108/0x220\n ? do_pte_missing+0x14a/0x3e0\n ? __handle_mm_fault+0x321/0x730\n ? count_memcg_events+0x13f/0x180\n ? handle_mm_fault+0x1fb/0x2d0\n ? do_user_addr_fault+0x20c/0x700\n ? syscall_exit_work+0x104/0x140\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x7f0c25b0feca\n [...]\n ---[ end trace 0000000000000000 ]---"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/37f26b9013b46457b0a96633fc3a7dc977d8beb1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6de4ef950dd56a6a81daf92d8a1d864fc6a56971",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cc51a66815999afb7e9cd845968de4fdf07567b7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cf4fc23d0d3d5b89b36f0d79f2674510bb574d8e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38629.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2025-38629",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:36.620",
"lastModified": "2025-08-22T16:15:36.620",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb: scarlett2: Fix missing NULL check\n\nscarlett2_input_select_ctl_info() sets up the string arrays allocated\nvia kasprintf(), but it misses NULL checks, which may lead to NULL\ndereference Oops. Let's add the proper NULL check."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/2c735fcaee81ad8056960659dc9dc460891e76b0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d558db85920b124bac36f8a7ddc5de0aa7491bdd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/df485a4b2b3ee5b35c80f990beb554e38a8a5fb1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38630.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2025-38630",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:36.750",
"lastModified": "2025-08-22T16:15:36.750",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref\n\nfb_add_videomode() can fail with -ENOMEM when its internal kmalloc() cannot\nallocate a struct fb_modelist. If that happens, the modelist stays empty but\nthe driver continues to register. Add a check for its return value to prevent\npoteintial null-ptr-deref, which is similar to the commit 17186f1f90d3 (\"fbdev:\nFix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var\")."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/40f0a51f6c54d46a94b9f1180339ede7ca7ee190",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/49377bac9e3bec1635065a033c9679214fe7593e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4b5d36cc3014986e6fac12eaa8433fe56801d4ce",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ac16154cccda8be10ee3ae188f10a06f3890bc5d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/da11e6a30e0bb8e911288bdc443b3dc8f6a7cac7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f060441c153495750804133555cf0a211a856892",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38631.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2025-38631",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:36.893",
"lastModified": "2025-08-22T16:15:36.893",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: imx95-blk-ctl: Fix synchronous abort\n\nWhen enabling runtime PM for clock suppliers that also belong to a power\ndomain, the following crash is thrown:\nerror: synchronous external abort: 0000000096000010 [#1] PREEMPT SMP\nWorkqueue: events_unbound deferred_probe_work_func\npstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : clk_mux_get_parent+0x60/0x90\nlr : clk_core_reparent_orphans_nolock+0x58/0xd8\n Call trace:\n clk_mux_get_parent+0x60/0x90\n clk_core_reparent_orphans_nolock+0x58/0xd8\n of_clk_add_hw_provider.part.0+0x90/0x100\n of_clk_add_hw_provider+0x1c/0x38\n imx95_bc_probe+0x2e0/0x3f0\n platform_probe+0x70/0xd8\n\nEnabling runtime PM without explicitly resuming the device caused\nthe power domain cut off after clk_register() is called. As a result,\na crash happens when the clock hardware provider is added and attempts\nto access the BLK_CTL register.\n\nFix this by using devm_pm_runtime_enable() instead of pm_runtime_enable()\nand getting rid of the pm_runtime_disable() in the cleanup path."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/533dc3cb375cabd8a2beba293d63ef2acd3d0005",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9f0ee0baf25b46bb82655c687718ebb0ae1def7b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b08217a257215ed9130fce93d35feba66b49bf0a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c1dead8bb303f86905ea6a09e5acda931165453b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38632.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2025-38632",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:37.033",
"lastModified": "2025-08-22T16:15:37.033",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npinmux: fix race causing mux_owner NULL with active mux_usecount\n\ncommit 5a3e85c3c397 (\"pinmux: Use sequential access to access\ndesc->pinmux data\") tried to address the issue when two client of the\nsame gpio calls pinctrl_select_state() for the same functionality, was\nresulting in NULL pointer issue while accessing desc->mux_owner.\nHowever, issue was not completely fixed due to the way it was handled\nand it can still result in the same NULL pointer.\n\nThe issue occurs due to the following interleaving:\n\n cpu0 (process A) cpu1 (process B)\n\n pin_request() { pin_free() {\n\n mutex_lock()\n desc->mux_usecount--; //becomes 0\n ..\n mutex_unlock()\n\n mutex_lock(desc->mux)\n desc->mux_usecount++; // becomes 1\n desc->mux_owner = owner;\n mutex_unlock(desc->mux)\n\n mutex_lock(desc->mux)\n desc->mux_owner = NULL;\n mutex_unlock(desc->mux)\n\nThis sequence leads to a state where the pin appears to be in use\n(`mux_usecount == 1`) but has no owner (`mux_owner == NULL`), which can\ncause NULL pointer on next pin_request on the same pin.\n\nEnsure that updates to mux_usecount and mux_owner are performed\natomically under the same lock. Only clear mux_owner when mux_usecount\nreaches zero and no new owner has been assigned."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0b075c011032f88d1cfde3b45d6dcf08b44140eb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/22b585cbd67d14df3b91529d1b990661c300faa9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9b2a3e7189028aa7c4d53a84364f2ea9fb209787",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9ea3f6b9a67be3476e331ce51cac316c2614a564",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b7bd6e3971eb7f0e34d2fdce1b18b08094e0c804",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38633.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2025-38633",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:37.173",
"lastModified": "2025-08-22T16:15:37.173",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: spacemit: mark K1 pll1_d8 as critical\n\nThe pll1_d8 clock is enabled by the boot loader, and is ultimately a\nparent for numerous clocks, including those used by APB and AXI buses.\nGuodong Xu discovered that this clock got disabled while responding to\ngetting -EPROBE_DEFER when requesting a reset controller.\n\nThe needed clock (CLK_DMA, along with its parents) had already been\nenabled. To respond to the probe deferral return, the CLK_DMA clock\nwas disabled, and this led to parent clocks also reducing their enable\ncount. When the enable count for pll1_d8 was decremented it became 0,\nwhich caused it to be disabled. This led to a system hang.\n\nMarking that clock critical resolves this by preventing it from being\ndisabled.\n\nDefine a new macro CCU_FACTOR_GATE_DEFINE() to allow clock flags to\nbe supplied for a CCU_FACTOR_GATE clock."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/10948c00e548e9ad2ce9d765baf26dce2d9b806b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7554729de27daf6d54bcf8689d863bbe267828bf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38634.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2025-38634",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:37.307",
"lastModified": "2025-08-22T16:15:37.307",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: cpcap-charger: Fix null check for power_supply_get_by_name\n\nIn the cpcap_usb_detect() function, the power_supply_get_by_name()\nfunction may return `NULL` instead of an error pointer.\nTo prevent potential null pointer dereferences, Added a null check."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/27001e4f146624c4b3389b029bdc0f8049819560",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8e9bdb563916287ba1b4258812434e0585ac6d00",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9784d832d7c103539cd9afb376534eaa35815d3d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a2436263144980cc99a9860c7b43335847afbe53",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d9fa3aae08f99493e67fb79413c0e95d30fca5e9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f642500aa7ed93d2606e4f929244cce9c7467b3a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38635.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2025-38635",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:37.450",
"lastModified": "2025-08-22T16:15:37.450",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: davinci: Add NULL check in davinci_lpsc_clk_register()\n\ndevm_kasprintf() returns NULL when memory allocation fails. Currently,\ndavinci_lpsc_clk_register() does not check for this case, which results\nin a NULL pointer dereference.\n\nAdd NULL check after devm_kasprintf() to prevent this issue and ensuring\nno resources are left allocated."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/105e8115944a9f93e9412abe7bb07ed96725adf9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/13de464f445d42738fe18c9a28bab056ba3a290a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1d92608a29251278015f57f3572bc950db7519f0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/23f564326deaafacfd7adf6104755b15216d8320",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6fb19cdcf040e1dec052a9032acb66cc2ad1d43f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7943ed1f05f5cb7372dca2aa227f848747a98791",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38636.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2025-38636",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:37.587",
"lastModified": "2025-08-22T16:15:37.587",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrv: Use strings in da monitors tracepoints\n\nUsing DA monitors tracepoints with KASAN enabled triggers the following\nwarning:\n\n BUG: KASAN: global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0\n Read of size 32 at addr ffffffffaada8980 by task ...\n Call Trace:\n <TASK>\n [...]\n do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0\n ? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10\n ? trace_event_sncid+0x83/0x200\n trace_event_sncid+0x163/0x200\n [...]\n The buggy address belongs to the variable:\n automaton_snep+0x4e0/0x5e0\n\nThis is caused by the tracepoints reading 32 bytes __array instead of\n__string from the automata definition. Such strings are literals and\nreading 32 bytes ends up in out of bound memory accesses (e.g. the next\nautomaton's data in this case).\nThe error is harmless as, while printing the string, we stop at the null\nterminator, but it should still be fixed.\n\nUse the __string facilities while defining the tracepoints to avoid\nreading out of bound memory."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0ebc70d973ce7a81826b5c4f55f743e07f5864d9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7f904ff6e58d398c4336f3c19c42b338324451f7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38638.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2025-38638",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:37.713",
"lastModified": "2025-08-22T16:15:37.713",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: add a retry logic in net6_rt_notify()\n\ninet6_rt_notify() can be called under RCU protection only.\nThis means the route could be changed concurrently\nand rt6_fill_node() could return -EMSGSIZE.\n\nRe-size the skb when this happens and retry, removing\none WARN_ON() that syzbot was able to trigger:\n\nWARNING: CPU: 3 PID: 6291 at net/ipv6/route.c:6342 inet6_rt_notify+0x475/0x4b0 net/ipv6/route.c:6342\nModules linked in:\nCPU: 3 UID: 0 PID: 6291 Comm: syz.0.77 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\n RIP: 0010:inet6_rt_notify+0x475/0x4b0 net/ipv6/route.c:6342\nCode: fc ff ff e8 6d 52 ea f7 e9 47 fc ff ff 48 8b 7c 24 08 4c 89 04 24 e8 5a 52 ea f7 4c 8b 04 24 e9 94 fd ff ff e8 9c fe 84 f7 90 <0f> 0b 90 e9 bd fd ff ff e8 6e 52 ea f7 e9 bb fb ff ff 48 89 df e8\nRSP: 0018:ffffc900035cf1d8 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffffc900035cf540 RCX: ffffffff8a36e790\nRDX: ffff88802f7e8000 RSI: ffffffff8a36e9d4 RDI: 0000000000000005\nRBP: ffff88803c230f00 R08: 0000000000000005 R09: 00000000ffffffa6\nR10: 00000000ffffffa6 R11: 0000000000000001 R12: 00000000ffffffa6\nR13: 0000000000000900 R14: ffff888032ea4100 R15: 0000000000000000\nFS: 00007fac7b89a6c0(0000) GS:ffff8880d6a20000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fac7b899f98 CR3: 0000000034b3f000 CR4: 0000000000352ef0\nCall Trace:\n <TASK>\n ip6_route_mpath_notify+0xde/0x280 net/ipv6/route.c:5356\n ip6_route_multipath_add+0x1181/0x1bd0 net/ipv6/route.c:5536\n inet6_rtm_newroute+0xe4/0x1a0 net/ipv6/route.c:5647\n rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:6944\n netlink_rcv_skb+0x155/0x420 net/netlink/af_netlink.c:2552\n netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]\n netlink_unicast+0x58d/0x850 net/netlink/af_netlink.c:1346\n netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1896\n sock_sendmsg_nosec net/socket.c:712 [inline]\n __sock_sendmsg net/socket.c:727 [inline]\n ____sys_sendmsg+0xa95/0xc70 net/socket.c:2566\n ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0bdca3439a22c70eb8f404acd61bf7aca5d731b0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ea2f921db7a483a526058c5b5b8162edd88dabe5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38639.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2025-38639",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:37.850",
"lastModified": "2025-08-22T16:15:37.850",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_nfacct: don't assume acct name is null-terminated\n\nBUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721\nRead of size 1 at addr ffff88801eac95c8 by task syz-executor183/5851\n[..]\n string+0x231/0x2b0 lib/vsprintf.c:721\n vsnprintf+0x739/0xf00 lib/vsprintf.c:2874\n [..]\n nfacct_mt_checkentry+0xd2/0xe0 net/netfilter/xt_nfacct.c:41\n xt_check_match+0x3d1/0xab0 net/netfilter/x_tables.c:523\n\nnfnl_acct_find_get() handles non-null input, but the error\nprintk relied on its presence."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/58004aa21e79addaf41667bfe65e93ec51653f18",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/58007fc7b94fb2702000045ff401eb7f5bde7828",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7c1ae471da69c09242834e956218ea6a42dd405a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bf58e667af7d96c8eb9411f926a0a0955f41ce21",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/df13c9c6ce1d55c31d1bd49db65a7fbbd86aab13",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e18939176e657a3a20bfbed357b8c55a9f82aba3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38640.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2025-38640",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:38.007",
"lastModified": "2025-08-22T16:15:38.007",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disable migration in nf_hook_run_bpf().\n\nsyzbot reported that the netfilter bpf prog can be called without\nmigration disabled in xmit path.\n\nThen the assertion in __bpf_prog_run() fails, triggering the splat\nbelow. [0]\n\nLet's use bpf_prog_run_pin_on_cpu() in nf_hook_run_bpf().\n\n[0]:\nBUG: assuming non migratable context at ./include/linux/filter.h:703\nin_atomic(): 0, irqs_disabled(): 0, migration_disabled() 0 pid: 5829, name: sshd-session\n3 locks held by sshd-session/5829:\n #0: ffff88807b4e4218 (sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1667 [inline]\n #0: ffff88807b4e4218 (sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_sendmsg+0x20/0x50 net/ipv4/tcp.c:1395\n #1: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]\n #1: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]\n #1: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x69/0x26c0 net/ipv4/ip_output.c:470\n #2: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]\n #2: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]\n #2: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: nf_hook+0xb2/0x680 include/linux/netfilter.h:241\nCPU: 0 UID: 0 PID: 5829 Comm: sshd-session Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120\n __cant_migrate kernel/sched/core.c:8860 [inline]\n __cant_migrate+0x1c7/0x250 kernel/sched/core.c:8834\n __bpf_prog_run include/linux/filter.h:703 [inline]\n bpf_prog_run include/linux/filter.h:725 [inline]\n nf_hook_run_bpf+0x83/0x1e0 net/netfilter/nf_bpf_link.c:20\n nf_hook_entry_hookfn include/linux/netfilter.h:157 [inline]\n nf_hook_slow+0xbb/0x200 net/netfilter/core.c:623\n nf_hook+0x370/0x680 include/linux/netfilter.h:272\n NF_HOOK_COND include/linux/netfilter.h:305 [inline]\n ip_output+0x1bc/0x2a0 net/ipv4/ip_output.c:433\n dst_output include/net/dst.h:459 [inline]\n ip_local_out net/ipv4/ip_output.c:129 [inline]\n __ip_queue_xmit+0x1d7d/0x26c0 net/ipv4/ip_output.c:527\n __tcp_transmit_skb+0x2686/0x3e90 net/ipv4/tcp_output.c:1479\n tcp_transmit_skb net/ipv4/tcp_output.c:1497 [inline]\n tcp_write_xmit+0x1274/0x84e0 net/ipv4/tcp_output.c:2838\n __tcp_push_pending_frames+0xaf/0x390 net/ipv4/tcp_output.c:3021\n tcp_push+0x225/0x700 net/ipv4/tcp.c:759\n tcp_sendmsg_locked+0x1870/0x42b0 net/ipv4/tcp.c:1359\n tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1396\n inet_sendmsg+0xb9/0x140 net/ipv4/af_inet.c:851\n sock_sendmsg_nosec net/socket.c:712 [inline]\n __sock_sendmsg net/socket.c:727 [inline]\n sock_write_iter+0x4aa/0x5b0 net/socket.c:1131\n new_sync_write fs/read_write.c:593 [inline]\n vfs_write+0x6c7/0x1150 fs/read_write.c:686\n ksys_write+0x1f8/0x250 fs/read_write.c:738\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fe7d365d407\nCode: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff\nRSP:"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0a356da16fb933abbeeb7aea038c351f3342cd3f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/17ce3e5949bc37557305ad46316f41c7875d6366",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/62f6175d145e00fc999fd2fcbffad3f59253c66a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e0199c28167a8a4adec036005a8df268b2b68529",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ee2502485702e4398cd74dbfb288bfa111d25e62",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38641.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2025-38641",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:38.150",
"lastModified": "2025-08-22T16:15:38.150",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: Fix potential NULL dereference on kmalloc failure\n\nAvoid potential NULL pointer dereference by checking the return value of\nkmalloc and handling allocation failure properly."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/5029d80bfc30b60ff57c70ccb04e027acb404f6a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b505902c66a282dcb01bcdc015aa1fdfaaa075db",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38642.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2025-38642",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:38.283",
"lastModified": "2025-08-22T16:15:38.283",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix WARN_ON for monitor mode on some devices\n\nOn devices without WANT_MONITOR_VIF (and probably without\nchannel context support) we get a WARN_ON for changing the\nper-link setting of a monitor interface.\n\nSince we already skip AP_VLAN interfaces and MONITOR with\nWANT_MONITOR_VIF and/or NO_VIRTUAL_MONITOR should update\nthe settings, catch this in the link change code instead\nof the warning."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1e10ded6b0f9b0eeefaacbb6c6c6afff3f702812",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c57e5b9819dfd16d709bcd6cb633301ed0829a66",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ff15498ebaa49c5429a74e70a1951dede60cd14c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38643.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2025-38643",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:38.417",
"lastModified": "2025-08-22T16:15:38.417",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac()\n\nCallers of wdev_chandef() must hold the wiphy mutex.\n\nBut the worker cfg80211_propagate_cac_done_wk() never takes the lock.\nWhich triggers the warning below with the mesh_peer_connected_dfs\ntest from hostapd and not (yet) released mac80211 code changes:\n\nWARNING: CPU: 0 PID: 495 at net/wireless/chan.c:1552 wdev_chandef+0x60/0x165\nModules linked in:\nCPU: 0 UID: 0 PID: 495 Comm: kworker/u4:2 Not tainted 6.14.0-rc5-wt-g03960e6f9d47 #33 13c287eeabfe1efea01c0bcc863723ab082e17cf\nWorkqueue: cfg80211 cfg80211_propagate_cac_done_wk\nStack:\n 00000000 00000001 ffffff00 6093267c\n 00000000 6002ec30 6d577c50 60037608\n 00000000 67e8d108 6063717b 00000000\nCall Trace:\n [<6002ec30>] ? _printk+0x0/0x98\n [<6003c2b3>] show_stack+0x10e/0x11a\n [<6002ec30>] ? _printk+0x0/0x98\n [<60037608>] dump_stack_lvl+0x71/0xb8\n [<6063717b>] ? wdev_chandef+0x60/0x165\n [<6003766d>] dump_stack+0x1e/0x20\n [<6005d1b7>] __warn+0x101/0x20f\n [<6005d3a8>] warn_slowpath_fmt+0xe3/0x15d\n [<600b0c5c>] ? mark_lock.part.0+0x0/0x4ec\n [<60751191>] ? __this_cpu_preempt_check+0x0/0x16\n [<600b11a2>] ? mark_held_locks+0x5a/0x6e\n [<6005d2c5>] ? warn_slowpath_fmt+0x0/0x15d\n [<60052e53>] ? unblock_signals+0x3a/0xe7\n [<60052f2d>] ? um_set_signals+0x2d/0x43\n [<60751191>] ? __this_cpu_preempt_check+0x0/0x16\n [<607508b2>] ? lock_is_held_type+0x207/0x21f\n [<6063717b>] wdev_chandef+0x60/0x165\n [<605f89b4>] regulatory_propagate_dfs_state+0x247/0x43f\n [<60052f00>] ? um_set_signals+0x0/0x43\n [<605e6bfd>] cfg80211_propagate_cac_done_wk+0x3a/0x4a\n [<6007e460>] process_scheduled_works+0x3bc/0x60e\n [<6007d0ec>] ? move_linked_works+0x4d/0x81\n [<6007d120>] ? assign_work+0x0/0xaa\n [<6007f81f>] worker_thread+0x220/0x2dc\n [<600786ef>] ? set_pf_worker+0x0/0x57\n [<60087c96>] ? to_kthread+0x0/0x43\n [<6008ab3c>] kthread+0x2d3/0x2e2\n [<6007f5ff>] ? worker_thread+0x0/0x2dc\n [<6006c05b>] ? calculate_sigpending+0x0/0x56\n [<6003b37d>] new_thread_handler+0x4a/0x64\nirq event stamp: 614611\nhardirqs last enabled at (614621): [<00000000600bc96b>] __up_console_sem+0x82/0xaf\nhardirqs last disabled at (614630): [<00000000600bc92c>] __up_console_sem+0x43/0xaf\nsoftirqs last enabled at (614268): [<00000000606c55c6>] __ieee80211_wake_queue+0x933/0x985\nsoftirqs last disabled at (614266): [<00000000606c52d6>] __ieee80211_wake_queue+0x643/0x985"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/2c5dee15239f3f3e31aa5c8808f18996c039e2c1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7022df2248c08c6f75a01714163ac902333bf3db",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dbce810607726408f889d3358f4780fd1436861e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38644.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2025-38644",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:38.567",
"lastModified": "2025-08-22T16:15:38.567",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: reject TDLS operations when station is not associated\n\nsyzbot triggered a WARN in ieee80211_tdls_oper() by sending\nNL80211_TDLS_ENABLE_LINK immediately after NL80211_CMD_CONNECT,\nbefore association completed and without prior TDLS setup.\n\nThis left internal state like sdata->u.mgd.tdls_peer uninitialized,\nleading to a WARN_ON() in code paths that assumed it was valid.\n\nReject the operation early if not in station mode or not associated."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0c84204cf0bbe89e454a5caccc6a908bc7db1542",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/16ecdab5446f15a61ec88eb0d23d25d009821db0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/31af06b574394530f68a4310c45ecbe2f68853c4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/378ae9ccaea3f445838a087962a067b5cb2e8577",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4df663d4c1ca386dcab2f743dfc9f0cc07aef73c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/af72badd5ee423eb16f6ad7fe0a62f1b4252d848",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38645.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2025-38645",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:38.727",
"lastModified": "2025-08-22T16:15:38.727",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Check device memory pointer before usage\n\nAdd a NULL check before accessing device memory to prevent a crash if\ndev->dm allocation in mlx5_init_once() fails."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/3046b011d368162b1b9ca9453eee0fea930e0a93",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4249f1307932f1b6bbb8b7eba60d82f0b7e44430",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/62d7cf455c887941ed6f105cd430ba04ee0b6c9f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/70f238c902b8c0461ae6fbb8d1a0bbddc4350eea",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/da899a1fd7c40e2e4302af1db7d0b8540fb22283",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/eebb225fe6c9103293807b8edabcbad59f9589bc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38646.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2025-38646",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:38.870",
"lastModified": "2025-08-22T16:15:38.870",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band\n\nWith a quite rare chance, RX report might be problematic to make SW think\na packet is received on 6 GHz band even if the chip does not support 6 GHz\nband actually. Since SW won't initialize stuffs for unsupported bands, NULL\ndereference will happen then in the sequence, rtw89_vif_rx_stats_iter() ->\nrtw89_core_cancel_6ghz_probe_tx(). So, add a check to avoid it.\n\nThe following is a crash log for this case.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000032\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: 0000 [#1] PREEMPT SMP NOPTI\n CPU: 1 PID: 1907 Comm: irq/131-rtw89_p Tainted: G U 6.6.56-05896-g89f5fb0eb30b #1 (HASH:1400 4)\n Hardware name: Google Telith/Telith, BIOS Google_Telith.15217.747.0 11/12/2024\n RIP: 0010:rtw89_vif_rx_stats_iter+0xd2/0x310 [rtw89_core]\n Code: 4c 89 7d c8 48 89 55 c0 49 8d 44 24 02 48 89 45 b8 45 31 ff eb 11\n 41 c6 45 3a 01 41 b7 01 4d 8b 6d 00 4d 39 f5 74 42 8b 43 10 <41> 33 45\n 32 0f b7 4b 14 66 41 33 4d 36 0f b7 c9 09 c1 74 d8 4d 85\n RSP: 0018:ffff9f3080138ca0 EFLAGS: 00010246\n RAX: 00000000b8bf5770 RBX: ffff91b5e8c639c0 RCX: 0000000000000011\n RDX: ffff91b582de1be8 RSI: 0000000000000000 RDI: ffff91b5e8c639e6\n RBP: ffff9f3080138d00 R08: 0000000000000000 R09: 0000000000000000\n R10: ffff91b59de70000 R11: ffffffffc069be50 R12: ffff91b5e8c639e4\n R13: 0000000000000000 R14: ffff91b5828020b8 R15: 0000000000000000\n FS: 0000000000000000(0000) GS:ffff91b8efa40000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000032 CR3: 00000002bf838000 CR4: 0000000000750ee0\n PKRU: 55555554\n Call Trace:\n <IRQ>\n ? __die_body+0x68/0xb0\n ? page_fault_oops+0x379/0x3e0\n ? exc_page_fault+0x4f/0xa0\n ? asm_exc_page_fault+0x22/0x30\n ? __pfx_rtw89_vif_rx_stats_iter+0x10/0x10 [rtw89_core (HASH:1400 5)]\n ? rtw89_vif_rx_stats_iter+0xd2/0x310 [rtw89_core (HASH:1400 5)]\n __iterate_interfaces+0x59/0x110 [mac80211 (HASH:1400 6)]\n ? __pfx_rtw89_vif_rx_stats_iter+0x10/0x10 [rtw89_core (HASH:1400 5)]\n ? __pfx_rtw89_vif_rx_stats_iter+0x10/0x10 [rtw89_core (HASH:1400 5)]\n ieee80211_iterate_active_interfaces_atomic+0x36/0x50 [mac80211 (HASH:1400 6)]\n rtw89_core_rx_to_mac80211+0xfd/0x1b0 [rtw89_core (HASH:1400 5)]\n rtw89_core_rx+0x43a/0x980 [rtw89_core (HASH:1400 5)]"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/4b525630729082f026e7030eafccf89e3add7eae",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/77a7a48f87d673a68664bebf044214821decbfda",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7e04f01bb94fe61c73cc59f0495c3b6c16a83231",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/892b29eab44b1803d2cad8e50f1bc2144ef478cb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f3527ac15a00916e68ecb495b74dbe6a6c62a06f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38647.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2025-38647",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:39.337",
"lastModified": "2025-08-22T16:15:39.337",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: sar: drop lockdep assertion in rtw89_set_sar_from_acpi\n\nThe following assertion is triggered on the rtw89 driver startup. It\nlooks meaningless to hold wiphy lock on the early init stage so drop the\nassertion.\n\n WARNING: CPU: 7 PID: 629 at drivers/net/wireless/realtek/rtw89/sar.c:502 rtw89_set_sar_from_acpi+0x365/0x4d0 [rtw89_core]\n CPU: 7 UID: 0 PID: 629 Comm: (udev-worker) Not tainted 6.15.0+ #29 PREEMPT(lazy)\n Hardware name: LENOVO 21D0/LNVNB161216, BIOS J6CN50WW 09/27/2024\n RIP: 0010:rtw89_set_sar_from_acpi+0x365/0x4d0 [rtw89_core]\n Call Trace:\n <TASK>\n rtw89_sar_init+0x68/0x2c0 [rtw89_core]\n rtw89_core_init+0x188e/0x1e50 [rtw89_core]\n rtw89_pci_probe+0x530/0xb50 [rtw89_pci]\n local_pci_probe+0xd9/0x190\n pci_call_probe+0x183/0x540\n pci_device_probe+0x171/0x2c0\n really_probe+0x1e1/0x890\n __driver_probe_device+0x18c/0x390\n driver_probe_device+0x4a/0x120\n __driver_attach+0x1a0/0x530\n bus_for_each_dev+0x10b/0x190\n bus_add_driver+0x2eb/0x540\n driver_register+0x1a3/0x3a0\n do_one_initcall+0xd5/0x450\n do_init_module+0x2cc/0x8f0\n init_module_from_file+0xe1/0x150\n idempotent_init_module+0x226/0x760\n __x64_sys_finit_module+0xcd/0x150\n do_syscall_64+0x94/0x380\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFound by Linux Verification Center (linuxtesting.org)."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/6fe21445f7e801de5527d420f8e25e97b0cdd7e2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f7ac6df92eee030151476078069dc3eb0002dfb0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38648.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2025-38648",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:39.480",
"lastModified": "2025-08-22T16:15:39.480",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: stm32: Check for cfg availability in stm32_spi_probe\n\nThe stm32_spi_probe function now includes a check to ensure that the\npointer returned by of_device_get_match_data is not NULL before\naccessing its members. This resolves a warning where a potential NULL\npointer dereference could occur when accessing cfg->has_device_mode.\n\nBefore accessing the 'has_device_mode' member, we verify that 'cfg' is\nnot NULL. If 'cfg' is NULL, an error message is logged.\n\nThis change ensures that the driver does not attempt to access\nconfiguration data if it is not available, thus preventing a potential\nsystem crash due to a NULL pointer dereference."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/21f1c800f6620e43f31dfd76709dbac8ebaa5a16",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3a571a8d52272cc26858ab1bc83d0f66e5dee938",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6031a54f4eac921efe6122a561d44df89b37f2d4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a7645815edf4478f3258bb0db95a08986a77f5c0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cc063d23ad80ef7d201c41b2716b1bae7c662cf9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38649.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2025-38649",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:39.617",
"lastModified": "2025-08-22T16:15:39.617",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight\n\nAn infinite loop has been created by the Coresight devices. When only a\nsource device is enabled, the coresight_find_activated_sysfs_sink function\nis recursively invoked in an attempt to locate an active sink device,\nultimately leading to a stack overflow and system crash. Therefore, disable\nthe replicator1 to break the infinite loop and prevent a potential stack\noverflow.\n\nreplicator1_out -> funnel_swao_in6 -> tmc_etf_swao_in -> tmc_etf_swao_out\n | |\nreplicator1_in replicator_swao_in\n | |\nreplicator0_out1 replicator_swao_out0\n | |\nreplicator0_in funnel_in1_in3\n | |\ntmc_etf_out <- tmc_etf_in <- funnel_merg_out <- funnel_merg_in1 <- funnel_in1_out\n\n[call trace]\n dump_backtrace+0x9c/0x128\n show_stack+0x20/0x38\n dump_stack_lvl+0x48/0x60\n dump_stack+0x18/0x28\n panic+0x340/0x3b0\n nmi_panic+0x94/0xa0\n panic_bad_stack+0x114/0x138\n handle_bad_stack+0x34/0xb8\n __bad_stack+0x78/0x80\n coresight_find_activated_sysfs_sink+0x28/0xa0 [coresight]\n coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\n coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\n coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\n coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\n ...\n coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\n coresight_enable_sysfs+0x80/0x2a0 [coresight]\n\nside effect after the change:\nOnly trace data originating from AOSS can reach the ETF_SWAO and EUD sinks."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/a9aaadcb0a6ce0c19616c46525112bc947c6f2b1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bd4f35786d5f0798cc1f8c187a81a7c998e6c58f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fbe5be7893b8c7f58c999a26839cd30bc07654c6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38650.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2025-38650",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:39.760",
"lastModified": "2025-08-22T16:15:39.760",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: remove mutex_lock check in hfsplus_free_extents\n\nSyzbot reported an issue in hfsplus filesystem:\n\n------------[ cut here ]------------\nWARNING: CPU: 0 PID: 4400 at fs/hfsplus/extents.c:346\n\thfsplus_free_extents+0x700/0xad0\nCall Trace:\n<TASK>\nhfsplus_file_truncate+0x768/0xbb0 fs/hfsplus/extents.c:606\nhfsplus_write_begin+0xc2/0xd0 fs/hfsplus/inode.c:56\ncont_expand_zero fs/buffer.c:2383 [inline]\ncont_write_begin+0x2cf/0x860 fs/buffer.c:2446\nhfsplus_write_begin+0x86/0xd0 fs/hfsplus/inode.c:52\ngeneric_cont_expand_simple+0x151/0x250 fs/buffer.c:2347\nhfsplus_setattr+0x168/0x280 fs/hfsplus/inode.c:263\nnotify_change+0xe38/0x10f0 fs/attr.c:420\ndo_truncate+0x1fb/0x2e0 fs/open.c:65\ndo_sys_ftruncate+0x2eb/0x380 fs/open.c:193\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nTo avoid deadlock, Commit 31651c607151 (\"hfsplus: avoid deadlock\non file truncation\") unlock extree before hfsplus_free_extents(),\nand add check wheather extree is locked in hfsplus_free_extents().\n\nHowever, when operations such as hfsplus_file_release,\nhfsplus_setattr, hfsplus_unlink, and hfsplus_get_block are executed\nconcurrently in different files, it is very likely to trigger the\nWARN_ON, which will lead syzbot and xfstest to consider it as an\nabnormality.\n\nThe comment above this warning also describes one of the easy\ntriggering situations, which can easily trigger and cause\nxfstest&syzbot to report errors.\n\n[task A]\t\t\t[task B]\n->hfsplus_file_release\n ->hfsplus_file_truncate\n ->hfs_find_init\n ->mutex_lock\n ->mutex_unlock\n\t\t\t\t->hfsplus_write_begin\n\t\t\t\t ->hfsplus_get_block\n\t\t\t\t ->hfsplus_file_extend\n\t\t\t\t ->hfsplus_ext_read_extent\n\t\t\t\t ->hfs_find_init\n\t\t\t\t\t ->mutex_lock\n ->hfsplus_free_extents\n WARN_ON(mutex_is_locked) !!!\n\nSeveral threads could try to lock the shared extents tree.\nAnd warning can be triggered in one thread when another thread\nhas locked the tree. This is the wrong behavior of the code and\nwe need to remove the warning."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/084933961ecda7561dedfb78c4676ccb90c91ada",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/314310166ba1fdff7660dfd9d18ea42d7058f7ae",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5055b7db94110f228961dea6b74eed0a93a50b01",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9764b8bb9f5f94df105cd2ac43829dd0d2c82b9f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a19ce9230b22a0866313932e7964cf05557a6008",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fcb96956c921f1aae7e7b477f2435c56f77a31b4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38651.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2025-38651",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:39.907",
"lastModified": "2025-08-22T16:15:39.907",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Fix warning from KUnit tests\n\nget_id_range() expects a positive value as first argument but\nget_random_u8() can return 0. Fix this by clamping it.\n\nValidated by running the test in a for loop for 1000 times.\n\nNote that MAX() is wrong as it is only supposed to be used for\nconstants, but max() is good here.\n\n [..] ok 9 test_range2_rand1\n [..] ok 10 test_range2_rand2\n [..] ok 11 test_range2_rand15\n [..] ------------[ cut here ]------------\n [..] WARNING: CPU: 6 PID: 104 at security/landlock/id.c:99 test_range2_rand16 (security/landlock/id.c:99 (discriminator 1) security/landlock/id.c:234 (discriminator 1))\n [..] Modules linked in:\n [..] CPU: 6 UID: 0 PID: 104 Comm: kunit_try_catch Tainted: G N 6.16.0-rc1-dev-00001-g314a2f98b65f #1 PREEMPT(undef)\n [..] Tainted: [N]=TEST\n [..] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n [..] RIP: 0010:test_range2_rand16 (security/landlock/id.c:99 (discriminator 1) security/landlock/id.c:234 (discriminator 1))\n [..] Code: 49 c7 c0 10 70 30 82 4c 89 ff 48 c7 c6 a0 63 1e 83 49 c7 45 a0 e0 63 1e 83 e8 3f 95 17 00 e9 1f ff ff ff 0f 0b e9 df fd ff ff <0f> 0b ba 01 00 00 00 e9 68 fe ff ff 49 89 45 a8 49 8d 4d a0 45 31\n\n [..] RSP: 0000:ffff888104eb7c78 EFLAGS: 00010246\n [..] RAX: 0000000000000000 RBX: 000000000870822c RCX: 0000000000000000\n ^^^^^^^^^^^^^^^^\n [..]\n [..] Call Trace:\n [..]\n [..] ---[ end trace 0000000000000000 ]---\n [..] ok 12 test_range2_rand16\n [..] # landlock_id: pass:12 fail:0 skip:0 total:12\n [..] # Totals: pass:12 fail:0 skip:0 total:12\n [..] ok 1 landlock_id\n\n[mic: Minor cosmetic improvements]"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/127183361b69dbb7ac3246ad4726f93400481249",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7d9ec2cfe12dd0d7c1a58213b9bef1bec66a3189",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e0a69cf2c03e61bd8069becb97f66c173d0d1fa1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38652.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2025-38652",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:40.057",
"lastModified": "2025-08-22T16:15:40.057",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid out-of-boundary access in devs.path\n\n- touch /mnt/f2fs/012345678901234567890123456789012345678901234567890123\n- truncate -s $((1024*1024*1024)) \\\n /mnt/f2fs/012345678901234567890123456789012345678901234567890123\n- touch /mnt/f2fs/file\n- truncate -s $((1024*1024*1024)) /mnt/f2fs/file\n- mkfs.f2fs /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \\\n -c /mnt/f2fs/file\n- mount /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \\\n /mnt/f2fs/loop\n\n[16937.192225] F2FS-fs (loop0): Mount Device [ 0]: /mnt/f2fs/012345678901234567890123456789012345678901234567890123\\xff\\x01, 511, 0 - 3ffff\n[16937.192268] F2FS-fs (loop0): Failed to find devices\n\nIf device path length equals to MAX_PATH_LEN, sbi->devs.path[] may\nnot end up w/ null character due to path array is fully filled, So\naccidently, fields locate after path[] may be treated as part of\ndevice path, result in parsing wrong device path.\n\nstruct f2fs_dev_info {\n...\n\tchar path[MAX_PATH_LEN];\n...\n};\n\nLet's add one byte space for sbi->devs.path[] to store null\ncharacter of device path string."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1b1efa5f0e878745e94a98022e8edc675a87d78e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/345fc8d1838f3f8be7c8ed08d86a13dedef67136",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3466721f06edff834f99d9f49f23eabc6b2cb78e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5661998536af52848cc4d52a377e90368196edea",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/70849d33130a2cf1d6010069ed200669c8651fbd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/755427093e4294ac111c3f9e40d53f681a0fbdaa",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38653.json
+41
View File
@@ -0,0 +1,41 @@
{
"id": "CVE-2025-38653",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:40.200",
"lastModified": "2025-08-22T16:15:40.200",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nproc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al\n\nCheck pde->proc_ops->proc_lseek directly may cause UAF in rmmod scenario. \nIt's a gap in proc_reg_open() after commit 654b33ada4ab(\"proc: fix UAF in\nproc_get_inode()\"). Followed by AI Viro's suggestion, fix it in same\nmanner."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1fccbfbae1dd36198dc47feac696563244ad81d3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/33c778ea0bd0fa62ff590497e72562ff90f82b13",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c35b0feb80b48720dfbbf4e33759c7be3faaebb6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d136502e04d8853a9aecb335d07bbefd7a1519a8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fc1072d934f687e1221d685cf1a49a5068318f34",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ff7ec8dc1b646296f8d94c39339e8d3833d16c05",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38654.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2025-38654",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:40.357",
"lastModified": "2025-08-22T16:15:40.357",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: canaan: k230: Fix order of DT parse and pinctrl register\n\nMove DT parse before pinctrl register. This ensures that device tree\nparsing is done before calling devm_pinctrl_register() to prevent using\nuninitialized pin resources."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/02c1deb1bff2b6d242e29a51e56107495979a2b8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/0ec03251d01494ef207089b5bd626becfd05fd86",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d94a32ac688f953dc9a9f12b5b4139ecad841bbb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38655.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2025-38655",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:40.493",
"lastModified": "2025-08-22T16:15:40.493",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: canaan: k230: add NULL check in DT parse\n\nAdd a NULL check for the return value of of_get_property() when\nretrieving the \"pinmux\" property in the group parser. This avoids\na potential NULL pointer dereference if the property is missing\nfrom the device tree node.\n\nAlso fix a typo (\"sintenel\") in the device ID match table comment,\ncorrecting it to \"sentinel\"."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/5d324b262c0ff256b8d603596574d66267b6394f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/65bd0be486390fc12a84eafaad78758c5e5a55e6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b5ae84aeff60b8819e8568ff0c57590caed9e6d3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38656.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2025-38656",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:40.633",
"lastModified": "2025-08-22T16:15:40.633",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()\n\nPreserve the error code if iwl_setup_deferred_work() fails. The current\ncode returns ERR_PTR(0) (which is NULL) on this path. I believe the\nmissing error code potentially leads to a use after free involving\ndebugfs."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1d068272c21d886d06526454b68368100ba0a720",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/991e2066f6009d3cb898413058c62dbcc92bd6d2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38657.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2025-38657",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:40.777",
"lastModified": "2025-08-22T16:15:40.777",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: mcc: prevent shift wrapping in rtw89_core_mlsr_switch()\n\nThe \"link_id\" value comes from the user via debugfs. If it's larger\nthan BITS_PER_LONG then that would result in shift wrapping and\npotentially an out of bounds access later. In fact, we can limit it\nto IEEE80211_MLD_MAX_NUM_LINKS (15).\n\nFortunately, only root can write to debugfs files so the security\nimpact is minimal."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/417cfa9cc44fbe6bceab786f9a4ee5a210f1288e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/53cf488927a0f79968f9c03c4d1e00d2a79731c3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38658.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2025-38658",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:40.907",
"lastModified": "2025-08-22T16:15:40.907",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: pci-epf: Do not complete commands twice if nvmet_req_init() fails\n\nHave nvmet_req_init() and req->execute() complete failed commands.\n\nDescription of the problem:\nnvmet_req_init() calls __nvmet_req_complete() internally upon failure,\ne.g., unsupported opcode, which calls the \"queue_response\" callback,\nthis results in nvmet_pci_epf_queue_response() being called, which will\ncall nvmet_pci_epf_complete_iod() if data_len is 0 or if dma_dir is\ndifferent from DMA_TO_DEVICE. This results in a double completion as\nnvmet_pci_epf_exec_iod_work() also calls nvmet_pci_epf_complete_iod()\nwhen nvmet_req_init() fails.\n\nSteps to reproduce:\nOn the host send a command with an unsupported opcode with nvme-cli,\nFor example the admin command \"security receive\"\n$ sudo nvme security-recv /dev/nvme0n1 -n1 -x4096\n\nThis triggers a double completion as nvmet_req_init() fails and\nnvmet_pci_epf_queue_response() is called, here iod->dma_dir is still\nin the default state of \"DMA_NONE\" as set by default in\nnvmet_pci_epf_alloc_iod(), so nvmet_pci_epf_complete_iod() is called.\nBecause nvmet_req_init() failed nvmet_pci_epf_complete_iod() is also\ncalled in nvmet_pci_epf_exec_iod_work() leading to a double completion.\nThis not only sends two completions to the host but also corrupts the\nstate of the PCI NVMe target leading to kernel oops.\n\nThis patch lets nvmet_req_init() and req->execute() complete all failed\ncommands, and removes the double completion case in\nnvmet_pci_epf_exec_iod_work() therefore fixing the edge cases where\ndouble completions occurred."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/746d0ac5a07d5da952ef258dd4d75f0b26c96476",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a535c0b10060bc8c174a7964b0f98064ee0c4774",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38659.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2025-38659",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:41.053",
"lastModified": "2025-08-22T16:15:41.053",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: No more self recovery\n\nWhen a node withdraws and it turns out that it is the only node that has\nthe filesystem mounted, gfs2 currently tries to replay the local journal\nto bring the filesystem back into a consistent state. Not only is that\na very bad idea, it has also never worked because gfs2_recover_func()\nwill refuse to do anything during a withdraw.\n\nHowever, before even getting to this point, gfs2_recover_func()\ndereferences sdp->sd_jdesc->jd_inode. This was a use-after-free before\ncommit 04133b607a78 (\"gfs2: Prevent double iput for journal on error\")\nand is a NULL pointer dereference since then.\n\nSimply get rid of self recovery to fix that."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1a91ba12abef628b43cada87478328274d988e88",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6784367b2f3cd7b89103de35764f37f152590dbd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/97c94c7dbddc34d353c83b541b3decabf98d04af",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/deb016c1669002e48c431d6fd32ea1c20ef41756",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f5426ffbec971a8f7346a57392d3a901bdee5a9b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38660.json
+33
View File
@@ -0,0 +1,33 @@
{
"id": "CVE-2025-38660",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:41.193",
"lastModified": "2025-08-22T16:15:41.193",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\n[ceph] parse_longname(): strrchr() expects NUL-terminated string\n\n... and parse_longname() is not guaranteed that. That's the reason\nwhy it uses kmemdup_nul() to build the argument for kstrtou64();\nthe problem is, kstrtou64() is not the only thing that need it.\n\nJust get a NUL-terminated copy of the entire thing and be done\nwith that..."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/101841c38346f4ca41dc1802c867da990ffb32eb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3145b2b11492d61c512bbc59660bb823bc757f48",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/493479af8af3ab907f49e99323777d498a4fbd2b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bb80f7618832d26f7e395f52f82b1dac76223e5f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38661.json
+25
View File
@@ -0,0 +1,25 @@
{
"id": "CVE-2025-38661",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:41.330",
"lastModified": "2025-08-22T16:15:41.330",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: alienware-wmi-wmax: Fix `dmi_system_id` array\n\nAdd missing empty member to `awcc_dmi_table`."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/660bcd9f1f94e623e1316b869b2172b36eb516d7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8346c6af27f1c1410eb314f4be5875fdf1579a10",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38662.json
+29
View File
@@ -0,0 +1,29 @@
{
"id": "CVE-2025-38662",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:41.450",
"lastModified": "2025-08-22T16:15:41.450",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv\n\nGiven mt8365_dai_set_priv allocate priv_size space to copy priv_data which\nmeans we should pass mt8365_i2s_priv[i] or \"struct mtk_afe_i2s_priv\"\ninstead of afe_priv which has the size of \"struct mt8365_afe_private\".\n\nOtherwise the KASAN complains about.\n\n[ 59.389765] BUG: KASAN: global-out-of-bounds in mt8365_dai_set_priv+0xc8/0x168 [snd_soc_mt8365_pcm]\n...\n[ 59.394789] Call trace:\n[ 59.395167] dump_backtrace+0xa0/0x128\n[ 59.395733] show_stack+0x20/0x38\n[ 59.396238] dump_stack_lvl+0xe8/0x148\n[ 59.396806] print_report+0x37c/0x5e0\n[ 59.397358] kasan_report+0xac/0xf8\n[ 59.397885] kasan_check_range+0xe8/0x190\n[ 59.398485] asan_memcpy+0x3c/0x98\n[ 59.399022] mt8365_dai_set_priv+0xc8/0x168 [snd_soc_mt8365_pcm]\n[ 59.399928] mt8365_dai_i2s_register+0x1e8/0x2b0 [snd_soc_mt8365_pcm]\n[ 59.400893] mt8365_afe_pcm_dev_probe+0x4d0/0xdf0 [snd_soc_mt8365_pcm]\n[ 59.401873] platform_probe+0xcc/0x228\n[ 59.402442] really_probe+0x340/0x9e8\n[ 59.402992] driver_probe_device+0x16c/0x3f8\n[ 59.403638] driver_probe_device+0x64/0x1d8\n[ 59.404256] driver_attach+0x1dc/0x4c8\n[ 59.404840] bus_for_each_dev+0x100/0x190\n[ 59.405442] driver_attach+0x44/0x68\n[ 59.405980] bus_add_driver+0x23c/0x500\n[ 59.406550] driver_register+0xf8/0x3d0\n[ 59.407122] platform_driver_register+0x68/0x98\n[ 59.407810] mt8365_afe_pcm_driver_init+0x2c/0xff8 [snd_soc_mt8365_pcm]"
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1dc0ed16cfbc3c28a07a89904071cfa802fdcee1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6bea85979d05470e6416a2bb504a9bcd9178304c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6e621dd99c57db916842865debaa65f20bbd6d8e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38663.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2025-38663",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:41.590",
"lastModified": "2025-08-22T16:15:41.590",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: reject invalid file types when reading inodes\n\nTo prevent inodes with invalid file types from tripping through the vfs\nand causing malfunctions or assertion failures, add a missing sanity check\nwhen reading an inode from a block device. If the file type is not valid,\ntreat it as a filesystem error."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1a5c204e175a78556b8ef1f7683249fa5197295a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/42cd46b3a8b1497b9258dc7ac445dbd6beb73e2f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4aead50caf67e01020c8be1945c3201e8a972a27",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/79663a15a1c70ca84f86f2dbba07b423fe7d5d4f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bf585ee198bba4ff25b0d80a0891df4656cb0d08",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38664.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2025-38664",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:41.723",
"lastModified": "2025-08-22T16:15:41.723",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix a null pointer dereference in ice_copy_and_init_pkg()\n\nAdd check for the return value of devm_kmemdup()\nto prevent potential null pointer dereference."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0fde7dccbf4c8a6d7940ecaf4c3d80a12f405dd7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1c30093d58cd3d02d8358e2b1f4a06a0aae0bf5b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3028f2a4e746b499043bbb8ab816f975473a0535",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4ff12d82dac119b4b99b5a78b5af3bf2474c0a36",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6d640a8ea62435a7f6f89869bee4fa99423d07ca",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
CVE-2025/CVE-2025-386xx/CVE-2025-38665.json
+37
View File
@@ -0,0 +1,37 @@
{
"id": "CVE-2025-38665",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-08-22T16:15:41.860",
"lastModified": "2025-08-22T16:15:41.860",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode\n\nAndrei Lalaev reported a NULL pointer deref when a CAN device is\nrestarted from Bus Off and the driver does not implement the struct\ncan_priv::do_set_mode callback.\n\nThere are 2 code path that call struct can_priv::do_set_mode:\n- directly by a manual restart from the user space, via\n can_changelink()\n- delayed automatic restart after bus off (deactivated by default)\n\nTo prevent the NULL pointer deference, refuse a manual restart or\nconfigure the automatic restart delay in can_changelink() and report\nthe error via extack to user space.\n\nAs an additional safety measure let can_restart() return an error if\ncan_priv::do_set_mode is not set instead of dereferencing it\nunchecked."
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/0ca816a96fdcf32644c80cbe7a82c7b6ce6ddda5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6acceb46180f9e160d4f0c56fcaf39ba562822ae",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6bbcf37c5114926c99a1d1e6993a5b35689d2599",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c1f3f9797c1f44a762e6f5f72520b2e520537b52",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cf81a60a973358dea163f6b14062f17831ceb894",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}
Loaded 100 of 159 files, more files were not shown because too many files have changed in this diff. Show more