Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-09-03 15:32:05 +00:00
parent db43c77409
commit 200a07d754
40 changed files with 824 additions and 67 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-6mmp-f4p3-97mr",
-  "modified": "2022-05-17T04:10:14Z",
+  "modified": "2024-09-03T15:30:38Z",
  "published": "2022-05-17T04:10:14Z",
  "aliases": [
    "CVE-2013-6040"
@@ -18,6 +18,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6040"
    },
+    {
+      "type": "WEB",
+      "url": "https://www.mw6tech.com"
+    },
    {
      "type": "WEB",
      "url": "http://www.exploit-db.com/exploits/31176"
@@ -28,6 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-22",
      "CWE-668"
    ],
    "severity": "HIGH",
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-25gf-472p-pjv4",
-  "modified": "2024-08-30T12:31:40Z",
+  "modified": "2024-09-03T15:30:40Z",
  "published": "2024-08-30T12:31:40Z",
  "aliases": [
    "CVE-2022-48944"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched: Fix yet more sched_fork() races\n\nWhere commit 4ef0c5c6b5ba (\"kernel/sched: Fix sched_fork() access an\ninvalid sched_task_group\") fixed a fork race vs cgroup, it opened up a\nrace vs syscalls by not placing the task on the runqueue before it\ngets exposed through the pidhash.\n\nCommit 13765de8148f (\"sched/fair: Fix fault in reweight_entity\") is\ntrying to fix a single instance of this, instead fix the whole class\nof issues, effectively reverting this commit.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -35,7 +38,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-30T11:15:14Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2w45-v2hv-rxp2",
-  "modified": "2024-08-21T00:30:29Z",
+  "modified": "2024-09-03T15:30:38Z",
  "published": "2024-08-21T00:30:29Z",
  "aliases": [
    "CVE-2024-43861"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: qmi_wwan: fix memory leak for not ip packets\n\nFree the unused skb when not ip packets arrive.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -53,9 +56,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-401"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-20T22:15:04Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3826-h8f4-w96h",
-  "modified": "2024-08-30T06:30:38Z",
+  "modified": "2024-09-03T15:30:40Z",
  "published": "2024-08-30T06:30:38Z",
  "aliases": [
    "CVE-2024-5879"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-52j9-r8mv-933c",
-  "modified": "2024-08-30T06:30:38Z",
+  "modified": "2024-09-03T15:30:40Z",
  "published": "2024-08-30T06:30:38Z",
  "aliases": [
    "CVE-2024-5061"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7f5w-jgw7-q73x",
-  "modified": "2024-08-29T18:31:35Z",
+  "modified": "2024-09-03T15:30:39Z",
  "published": "2024-08-29T18:31:35Z",
  "aliases": [
    "CVE-2024-43946"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7j47-mxwc-g3xp",
-  "modified": "2024-08-21T03:31:53Z",
+  "modified": "2024-09-03T15:30:39Z",
  "published": "2024-08-21T03:31:53Z",
  "aliases": [
    "CVE-2024-43872"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix soft lockup under heavy CEQE load\n\nCEQEs are handled in interrupt handler currently. This may cause the\nCPU core staying in interrupt context too long and lead to soft lockup\nunder heavy load.\n\nHandle CEQEs in BH workqueue and set an upper limit for the number of\nCEQE handled by a single call of work handler.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-667"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-21T01:15:11Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7pwv-g7hj-39pr",
-  "modified": "2024-08-20T18:31:21Z",
+  "modified": "2024-09-03T15:30:38Z",
  "published": "2024-08-19T21:35:10Z",
  "aliases": [
    "CVE-2024-7592"
@@ -29,6 +29,14 @@
      "type": "WEB",
      "url": "https://github.com/python/cpython/pull/123075"
    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1"
+    },
    {
      "type": "WEB",
      "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8gxf-54jp-wccf",
-  "modified": "2024-08-21T00:30:29Z",
+  "modified": "2024-09-03T15:30:39Z",
  "published": "2024-08-21T00:30:29Z",
  "aliases": [
    "CVE-2024-43862"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wan: fsl_qmc_hdlc: Convert carrier_lock spinlock to a mutex\n\nThe carrier_lock spinlock protects the carrier detection. While it is\nheld, framer_get_status() is called which in turn takes a mutex.\nThis is not correct and can lead to a deadlock.\n\nA run with PROVE_LOCKING enabled detected the issue:\n  [ BUG: Invalid wait context ]\n  ...\n  c204ddbc (&framer->mutex){+.+.}-{3:3}, at: framer_get_status+0x40/0x78\n  other info that might help us debug this:\n  context-{4:4}\n  2 locks held by ifconfig/146:\n  #0: c0926a38 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x12c/0x664\n  #1: c2006a40 (&qmc_hdlc->carrier_lock){....}-{2:2}, at: qmc_hdlc_framer_set_carrier+0x30/0x98\n\nAvoid the spinlock usage and convert carrier_lock to a mutex.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-667"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-21T00:15:04Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-f95q-fwq6-mx8w",
-  "modified": "2024-08-21T00:30:29Z",
+  "modified": "2024-09-03T15:30:39Z",
  "published": "2024-08-21T00:30:29Z",
  "aliases": [
    "CVE-2024-43863"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Fix a deadlock in dma buf fence polling\n\nIntroduce a version of the fence ops that on release doesn't remove\nthe fence from the pending list, and thus doesn't require a lock to\nfix poll->fence wait->fence unref deadlocks.\n\nvmwgfx overwrites the wait callback to iterate over the list of all\nfences and update their status, to do that it holds a lock to prevent\nthe list modifcations from other threads. The fence destroy callback\nboth deletes the fence and removes it from the list of pending\nfences, for which it holds a lock.\n\ndma buf polling cb unrefs a fence after it's been signaled: so the poll\ncalls the wait, which signals the fences, which are being destroyed.\nThe destruction tries to acquire the lock on the pending fences list\nwhich it can never get because it's held by the wait from which it\nwas called.\n\nOld bug, but not a lot of userspace apps were using dma-buf polling\ninterfaces. Fix those, in particular this fixes KDE stalls/deadlock.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -41,9 +44,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-667"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-21T00:15:04Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-ffxp-34wc-r8r7",
-  "modified": "2024-08-30T12:31:40Z",
+  "modified": "2024-09-03T15:30:40Z",
  "published": "2024-08-30T12:31:40Z",
  "aliases": [
    "CVE-2024-8252"
@@ -40,6 +40,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-829",
      "CWE-98"
    ],
    "severity": "HIGH",
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-hff3-p4h7-f98r",
-  "modified": "2024-08-30T09:31:17Z",
+  "modified": "2024-09-03T15:30:40Z",
  "published": "2024-08-30T09:31:17Z",
  "aliases": [
    "CVE-2024-42412"
  ],
  "details": "Cross-site scripting vulnerability exists in WAB-I1750-PS and WAB-S1167-PS due to improper processing of input values in menu.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-30T07:15:12Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-jvr7-jmp5-9485",
-  "modified": "2024-08-30T09:31:17Z",
+  "modified": "2024-09-03T15:30:40Z",
  "published": "2024-08-30T09:31:17Z",
  "aliases": [
    "CVE-2024-34577"
  ],
  "details": "Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, and WRC-X3000GS2A-B due to improper processing of input values in easysetup.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-30T07:15:11Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-rjp6-gjq7-25v6",
-  "modified": "2024-08-21T03:31:53Z",
+  "modified": "2024-09-03T15:30:39Z",
  "published": "2024-08-21T03:31:53Z",
  "aliases": [
    "CVE-2024-43873"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost/vsock: always initialize seqpacket_allow\n\nThere are two issues around seqpacket_allow:\n1. seqpacket_allow is not initialized when socket is\n   created. Thus if features are never set, it will be\n   read uninitialized.\n2. if VIRTIO_VSOCK_F_SEQPACKET is set and then cleared,\n   then seqpacket_allow will not be cleared appropriately\n   (existing apps I know about don't usually do this but\n    it's legal and there's no way to be sure no one relies\n    on this).\n\nTo fix:\n\t- initialize seqpacket_allow after allocation\n\t- set it unconditionally in set_features",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -41,9 +44,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-909"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-21T01:15:11Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-rmc5-c4fj-6pr3",
-  "modified": "2024-08-29T18:31:35Z",
+  "modified": "2024-09-03T15:30:39Z",
  "published": "2024-08-29T18:31:35Z",
  "aliases": [
    "CVE-2024-43935"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-x2xj-658j-798f",
-  "modified": "2024-08-21T03:31:53Z",
+  "modified": "2024-09-03T15:30:39Z",
  "published": "2024-08-21T03:31:53Z",
  "aliases": [
    "CVE-2024-43871"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndevres: Fix memory leakage caused by driver API devm_free_percpu()\n\nIt will cause memory leakage when use driver API devm_free_percpu()\nto free memory allocated by devm_alloc_percpu(), fixed by using\ndevres_release() instead of devres_destroy() within devm_free_percpu().",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -53,9 +56,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-401"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-21T01:15:11Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-x66f-v9ww-9c9p",
-  "modified": "2024-08-19T06:30:53Z",
+  "modified": "2024-09-03T15:30:38Z",
  "published": "2024-08-17T09:30:25Z",
  "aliases": [
    "CVE-2024-42308"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check for NULL pointer\n\n[why & how]\nNeed to make sure plane_state is initialized\nbefore accessing its members.\n\n(cherry picked from commit 295d91cbc700651782a60572f83c24861607b648)",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -49,9 +52,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-476"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-17T09:15:10Z"
--- a/Show More
+++ b/Show More