mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Advisory Database Sync
This commit is contained in:
advisory-database[bot]
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-rwch-8cp4-7v7r",
|
||||
"modified": "2025-05-02T09:30:24Z",
|
||||
"modified": "2025-05-09T09:33:17Z",
|
||||
"published": "2024-04-03T18:30:42Z",
|
||||
"aliases": [
|
||||
"CVE-2024-26739"
|
||||
@@ -27,6 +27,10 @@
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/28cdbbd38a4413b8eff53399b3f872fd4e80db9d"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/9d3ef89b6a5e9f2e940de2cef3d543be0be8dec5"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/e873e8f7d03a2ee5b77fb1a305c782fed98e2754"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-vjmq-27j9-636j",
|
||||
"modified": "2025-05-02T09:30:26Z",
|
||||
"modified": "2025-05-09T09:33:18Z",
|
||||
"published": "2024-06-19T15:30:52Z",
|
||||
"aliases": [
|
||||
"CVE-2024-38541"
|
||||
@@ -27,6 +27,10 @@
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/5d59fd637a8af42b211a92b2edb2474325b4d488"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/c7f24b7d94549ff4623e8f41ea4d9f5319bd8ac8"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/cf7385cb26ac4f0ee6c7385960525ad534323252"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-m3hv-89f3-wrrc",
|
||||
"modified": "2024-09-13T18:31:42Z",
|
||||
"modified": "2025-05-09T09:33:18Z",
|
||||
"published": "2024-09-11T18:31:06Z",
|
||||
"aliases": [
|
||||
"CVE-2024-45027"
|
||||
@@ -19,6 +19,10 @@
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45027"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/3efb29f6a78d4746f958c1ab6cd7981c5762f03b"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/770cacc75b0091ece17349195d72133912c1ca7c"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-m8v3-m369-c2xp",
|
||||
"modified": "2025-03-07T09:30:35Z",
|
||||
"modified": "2025-05-09T09:33:18Z",
|
||||
"published": "2025-03-07T09:30:35Z",
|
||||
"aliases": [
|
||||
"CVE-2025-21839"
|
||||
@@ -18,6 +18,18 @@
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/4eb063de686bfcdfd03a8c801d1bbe87d2d5eb55"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/93eeb6df1605b3a24f38afdba7ab903ba6b64133"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/9efb2b99b96c86664bbdbdd2cdb354ac9627eb20"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/a1723e9c53fe6431415be19302a56543daf503f5"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/c2fee09fc167c74a64adb08656cb993ea475197e"
|
||||
|
||||
@@ -0,0 +1,57 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-23wv-q9m5-hq8q",
|
||||
"modified": "2025-05-09T09:33:20Z",
|
||||
"published": "2025-05-09T09:33:20Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37881"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()\n\nThe variable d->name, returned by devm_kasprintf(), could be NULL.\nA pointer check is added to prevent potential NULL pointer dereference.\nThis is similar to the fix in commit 3027e7b15b02\n(\"ice: Fix some null pointer dereference issues in ice_ptp.c\").\n\nThis issue is found by our static analysis tool",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37881"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/052fb65335befeae8500e88d69ea022266baaf6d"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/36d68151712e525450f0fbb3045e7110f0d9b610"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/61006ca381b4d65d2b8ca695ea8da1ce18d6dee3"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/8c75f3e6a433d92084ad4e78b029ae680865420f"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/a777ccfb9ba8d43f745e41b69ba39d4a506a081e"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/c8d4faf452a627f9b09c3a5c366133a19e5b7a28"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/cfa7984f69359761b07a7831c1258c0fde1e0389"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/d26a6093d52904cacdbb75424c323c19b443a890"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-09T07:16:09Z"
|
||||
}
|
||||
}
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-28h8-49pj-mw67",
|
||||
"modified": "2025-05-05T15:30:53Z",
|
||||
"modified": "2025-05-09T09:33:18Z",
|
||||
"published": "2025-05-05T15:30:53Z",
|
||||
"aliases": [
|
||||
"CVE-2024-58100"
|
||||
@@ -18,6 +18,10 @@
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/3846e2bea565ee1c5195dcc625fda9868fb0e3b3"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/7197fc4acdf238ec8ad06de5a8235df0c1f9c7d7"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/81f6d0530ba031b5f038a091619bf2ff29568852"
|
||||
|
||||
@@ -0,0 +1,49 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2c7r-jxv5-347c",
|
||||
"modified": "2025-05-09T09:33:21Z",
|
||||
"published": "2025-05-09T09:33:20Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37883"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/sclp: Add check for get_zeroed_page()\n\nAdd check for the return value of get_zeroed_page() in\nsclp_console_init() to prevent null pointer dereference.\nFurthermore, to solve the memory leak caused by the loop\nallocation, add a free helper to do the free job.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37883"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/28e5a867aa542e369e211c2baba7044228809a99"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/397254706eba9d8f99fd237feede7ab3169a7f9a"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/3b3aa72636a6205933609ec274a8747720c1ee3f"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/3db42c75a921854a99db0a2775814fef97415bac"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/e1e00dc45648125ef7cb87ebc3b581ac224e7b39"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/f69f8a93aacf6e99af7b1cc992d8ca2cc07b96fb"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-09T07:16:09Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2cm8-23hq-x283",
|
||||
"modified": "2025-05-09T09:33:19Z",
|
||||
"published": "2025-05-09T09:33:19Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37847"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/ivpu: Fix deadlock in ivpu_ms_cleanup()\n\nFix deadlock in ivpu_ms_cleanup() by preventing runtime resume after\nfile_priv->ms_lock is acquired.\n\nDuring a failure in runtime resume, a cold boot is executed, which\ncalls ivpu_ms_cleanup_all(). This function calls ivpu_ms_cleanup()\nthat acquires file_priv->ms_lock and causes the deadlock.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37847"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/019634f27a16796eab749e8107dae32099945f29"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/7d12a7d43c7bab9097ba466581d8db702e7908dc"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/9a6f56762d23a1f3af15e67901493c927caaf882"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/f996ecc789b5dbaaf38b6ec0a1917821789cbd9c"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-09T07:16:05Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2x8x-5r7x-jcgh",
|
||||
"modified": "2025-05-09T09:33:20Z",
|
||||
"published": "2025-05-09T09:33:20Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37886"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: make wait_context part of q_info\n\nMake the wait_context a full part of the q_info struct rather\nthan a stack variable that goes away after pdsc_adminq_post()\nis done so that the context is still available after the wait\nloop has given up.\n\nThere was a case where a slow development firmware caused\nthe adminq request to time out, but then later the FW finally\nfinished the request and sent the interrupt. The handler tried\nto complete_all() the completion context that had been created\non the stack in pdsc_adminq_post() but no longer existed.\nThis caused bad pointer usage, kernel crashes, and much wailing\nand gnashing of teeth.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37886"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/1d7c4b2b0bbfb09b55b2dc0e2355d7936bf89381"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/3f77c3dfffc7063428b100c4945ca2a7a8680380"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/520f012fe75fb8efc9f16a57ef929a7a2115d892"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/66d7702b42ffdf0dce4808626088268a4e905ca6"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-09T07:16:09Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,37 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3hq4-hxjg-vwx8",
|
||||
"modified": "2025-05-09T09:33:19Z",
|
||||
"published": "2025-05-09T09:33:19Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37842"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: fsl-qspi: use devm function instead of driver remove\n\nDriver use devm APIs to manage clk/irq/resources and register the spi\ncontroller, but the legacy remove function will be called first during\ndevice detach and trigger kernel panic. Drop the remove function and use\ndevm_add_action_or_reset() for driver cleanup to ensure the release\nsequence.\n\nTrigger kernel panic on i.MX8MQ by\necho 30bb0000.spi >/sys/bus/platform/drivers/fsl-quadspi/unbind",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37842"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/40369bfe717e96e26650eeecfa5a6363563df6e4"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/439688dbe82baa10d4430dc3252bb5ef1183a171"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/f9bfb3a5f6f616f3eb7665c8ff3bcb9760ae33c8"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-09T07:16:04Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3p47-qj26-6gg7",
|
||||
"modified": "2025-05-09T09:33:20Z",
|
||||
"published": "2025-05-09T09:33:20Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37866"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show()\n\nA warning is seen when running the latest kernel on a BlueField SOC:\n[251.512704] ------------[ cut here ]------------\n[251.512711] invalid sysfs_emit: buf:0000000003aa32ae\n[251.512720] WARNING: CPU: 1 PID: 705264 at fs/sysfs/file.c:767 sysfs_emit+0xac/0xc8\n\nThe warning is triggered because the mlxbf-bootctl driver invokes\n\"sysfs_emit()\" with a buffer pointer that is not aligned to the\nstart of the page. The driver should instead use \"sysfs_emit_at()\"\nto support non-zero offsets into the destination buffer.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37866"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/5e1dcc5bfd7a2896178c604bc69d6ab9650967da"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/b129005ddfc0e6daf04a6d3b928a9e474f9b3918"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-09T07:16:07Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,37 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3qx6-96c8-pv99",
|
||||
"modified": "2025-05-09T09:33:20Z",
|
||||
"published": "2025-05-09T09:33:20Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37882"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Fix isochronous Ring Underrun/Overrun event handling\n\nThe TRB pointer of these events points at enqueue at the time of error\noccurrence on xHCI 1.1+ HCs or it's NULL on older ones. By the time we\nare handling the event, a new TD may be queued at this ring position.\n\nI can trigger this race by rising interrupt moderation to increase IRQ\nhandling delay. Similar delay may occur naturally due to system load.\n\nIf this ever happens after a Missed Service Error, missed TDs will be\nskipped and the new TD processed as if it matched the event. It could\nbe given back prematurely, risking data loss or buffer UAF by the xHC.\n\nDon't complete TDs on xrun events and don't warn if queued TDs don't\nmatch the event's TRB pointer, which can be NULL or a link/no-op TRB.\nDon't warn if there are no queued TDs at all.\n\nNow that it's safe, also handle xrun events if the skip flag is clear.\nThis ensures completion of any TD stuck in 'error mid TD' state right\nbefore the xrun event, which could happen if a driver submits a finite\nnumber of URBs to a buggy HC and then an error occurs on the last TD.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37882"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/16a7a8e6c47fea5c847beb696c8c21a7a44c1915"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/39a080a2925c81b0f1da0add44722ef2b78e5454"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/906dec15b9b321b546fd31a3c99ffc13724c7af4"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-09T07:16:09Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,37 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3v3m-75mh-5x2r",
|
||||
"modified": "2025-05-09T09:33:20Z",
|
||||
"published": "2025-05-09T09:33:20Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37877"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu: Clear iommu-dma ops on cleanup\n\nIf iommu_device_register() encounters an error, it can end up tearing\ndown already-configured groups and default domains, however this\ncurrently still leaves devices hooked up to iommu-dma (and even\nhistorically the behaviour in this area was at best inconsistent across\narchitectures/drivers...) Although in the case that an IOMMU is present\nwhose driver has failed to probe, users cannot necessarily expect DMA to\nwork anyway, it's still arguable that we should do our best to put\nthings back as if the IOMMU driver was never there at all, and certainly\nthe potential for crashing in iommu-dma itself is undesirable. Make sure\nwe clean up the dev->dma_iommu flag along with everything else.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37877"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/104a84276821aed0ed241ce0d82d6c3267e3fcb8"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/280e5a30100578106a4305ce0118e0aa9b866f12"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/b14d98641312d972bb3f38e82eddf92898522389"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-09T07:16:08Z"
|
||||
}
|
||||
}
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3xgc-7mw7-pvhp",
|
||||
"modified": "2025-05-07T15:31:46Z",
|
||||
"modified": "2025-05-09T09:33:18Z",
|
||||
"published": "2025-05-07T15:31:46Z",
|
||||
"aliases": [
|
||||
"CVE-2025-47549"
|
||||
@@ -19,9 +19,17 @@
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47549"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/d0n601/CVE-2025-47549"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://patchstack.com/database/wordpress/plugin/beaf-before-and-after-gallery/vulnerability/wordpress-beaf-4-6-10-arbitrary-file-upload-vulnerability?_s_id=cve"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://ryankozak.com/posts/cve-2025-47549"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-4f99-6w2j-877c",
|
||||
"modified": "2025-05-09T06:32:36Z",
|
||||
"modified": "2025-05-09T09:33:18Z",
|
||||
"published": "2025-05-03T00:30:32Z",
|
||||
"aliases": [
|
||||
"CVE-2022-21546"
|
||||
@@ -23,6 +23,10 @@
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/linus/ccd3f449052449a917a3e577d8ba0368f43b8f29"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/4226622647e3e5ac06d3ebc1605b917446157510"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/ccd3f449052449a917a3e577d8ba0368f43b8f29"
|
||||
|
||||
@@ -0,0 +1,49 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-4wfv-x2vf-68j5",
|
||||
"modified": "2025-05-09T09:33:19Z",
|
||||
"published": "2025-05-09T09:33:19Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37849"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Tear down vGIC on failed vCPU creation\n\nIf kvm_arch_vcpu_create() fails to share the vCPU page with the\nhypervisor, we propagate the error back to the ioctl but leave the\nvGIC vCPU data initialised. Note only does this leak the corresponding\nmemory when the vCPU is destroyed but it can also lead to use-after-free\nif the redistributor device handling tries to walk into the vCPU.\n\nAdd the missing cleanup to kvm_arch_vcpu_create(), ensuring that the\nvGIC vCPU structures are destroyed on error.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37849"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/07476e0d932afc53c05468076393ac35d0b4999e"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/2480326eba8ae9ccc5e4c3c2dc8d407db68e3c52"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/250f25367b58d8c65a1b060a2dda037eea09a672"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/5085e02362b9948f82fceca979b8f8e12acb1cc5"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/c322789613407647a05ff5c451a7bf545fb34e73"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/f1e9087abaeedec9bf2894a282ee4f0d8383f299"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-09T07:16:05Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,37 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-59x3-j3qw-gjfx",
|
||||
"modified": "2025-05-09T09:33:20Z",
|
||||
"published": "2025-05-09T09:33:20Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37869"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Use local fence in error path of xe_migrate_clear\n\nThe intent of the error path in xe_migrate_clear is to wait on locally\ngenerated fence and then return. The code is waiting on m->fence which\ncould be the local fence but this is only stable under the job mutex\nleading to a possible UAF. Fix code to wait on local fence.\n\n(cherry picked from commit 762b7e95362170b3e13a8704f38d5e47eca4ba74)",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37869"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/20659d3150f1a2a258a173fe011013178ff2a197"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/2ac5f466f62892a7d1ac2d1a3eb6cd14efbe2f2d"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/dc712938aa26b001f448d5e93f59d57fa80f2dbd"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-09T07:16:07Z"
|
||||
}
|
||||
}
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-5c72-frqm-r8r4",
|
||||
"modified": "2025-05-08T09:30:25Z",
|
||||
"modified": "2025-05-09T09:33:18Z",
|
||||
"published": "2025-05-08T09:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37819"
|
||||
@@ -29,6 +29,14 @@
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/47bee0081b483b077c7560bc5358ad101f89c8ef"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/dc0d654eb4179b06d3206e4396d072108b9ba082"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/f95659affee301464f0d058d528d96b35b452da8"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
|
||||
@@ -0,0 +1,53 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-5m63-6f39-c6xq",
|
||||
"modified": "2025-05-09T09:33:20Z",
|
||||
"published": "2025-05-09T09:33:20Z",
|
||||
"aliases": [
|
||||
"CVE-2025-37867"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Silence oversized kvmalloc() warning\n\nsyzkaller triggered an oversized kvmalloc() warning.\nSilence it by adding __GFP_NOWARN.\n\nsyzkaller log:\n WARNING: CPU: 7 PID: 518 at mm/util.c:665 __kvmalloc_node_noprof+0x175/0x180\n CPU: 7 UID: 0 PID: 518 Comm: c_repro Not tainted 6.11.0-rc6+ #6\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n RIP: 0010:__kvmalloc_node_noprof+0x175/0x180\n RSP: 0018:ffffc90001e67c10 EFLAGS: 00010246\n RAX: 0000000000000100 RBX: 0000000000000400 RCX: ffffffff8149d46b\n RDX: 0000000000000000 RSI: ffff8881030fae80 RDI: 0000000000000002\n RBP: 000000712c800000 R08: 0000000000000100 R09: 0000000000000000\n R10: ffffc90001e67c10 R11: 0030ae0601000000 R12: 0000000000000000\n R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000000\n FS: 00007fde79159740(0000) GS:ffff88813bdc0000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000020000180 CR3: 0000000105eb4005 CR4: 00000000003706b0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n <TASK>\n ib_umem_odp_get+0x1f6/0x390\n mlx5_ib_reg_user_mr+0x1e8/0x450\n ib_uverbs_reg_mr+0x28b/0x440\n ib_uverbs_write+0x7d3/0xa30\n vfs_write+0x1ac/0x6c0\n ksys_write+0x134/0x170\n ? __sanitizer_cov_trace_pc+0x1c/0x50\n do_syscall_64+0x50/0x110\n entry_SYSCALL_64_after_hwframe+0x76/0x7e",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37867"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/0d81bb58a203ad5f4044dc18cfbc230c194f650a"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/6c588e9afbab240c921f936cb676dac72e2e2b66"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/791daf8240cedf27af8794038ae1d32ef643bce6"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/9a0e6f15029e1a8a21e40f06fd05aa52b7f063de"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/ae470d06320dea4002d441784d691f0a26b4322d"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/f476eba25fdf70faa7b19a3e0fb00e65c5b53106"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/f94ac90ce7bd6f9266ad0d99044ed86e8d1416c1"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-09T07:16:07Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,56 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-64h2-9x78-c693",
|
||||
"modified": "2025-05-09T09:33:21Z",
|
||||
"published": "2025-05-09T09:33:21Z",
|
||||
"aliases": [
|
||||
"CVE-2025-4470"
|
||||
],
|
||||
"details": "A vulnerability classified as problematic was found in SourceCodester Online Student Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add-student.php. The manipulation of the argument Fullname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
|
||||
},
|
||||
{
|
||||
"type": "CVSS_V4",
|
||||
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4470"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/Colorado-all/cve/blob/main/Online%20Student%20Clearance%20System/xss-2.md"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://vuldb.com/?ctiid.308089"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://vuldb.com/?id.308089"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://vuldb.com/?submit.566249"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.sourcecodester.com"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-79"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-05-09T07:16:11Z"
|
||||
}
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user