From 3fa8eca84bba7157f41ffb74003ab4b1ac82eaa2 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Sun, 2 Mar 2025 15:31:57 +0000 Subject: [PATCH] Publish Advisories GHSA-2r5w-7wp5-72qw GHSA-73xw-qxgf-j8c4 GHSA-77wf-7c6r-cx8j GHSA-g9wm-f4gx-rwmf --- .../GHSA-2r5w-7wp5-72qw.json | 52 +++++++++++++++ .../GHSA-73xw-qxgf-j8c4.json | 45 +++++++++++++ .../GHSA-77wf-7c6r-cx8j.json | 64 +++++++++++++++++++ .../GHSA-g9wm-f4gx-rwmf.json | 25 ++++++++ 4 files changed, 186 insertions(+) create mode 100644 advisories/unreviewed/2025/03/GHSA-2r5w-7wp5-72qw/GHSA-2r5w-7wp5-72qw.json create mode 100644 advisories/unreviewed/2025/03/GHSA-73xw-qxgf-j8c4/GHSA-73xw-qxgf-j8c4.json create mode 100644 advisories/unreviewed/2025/03/GHSA-77wf-7c6r-cx8j/GHSA-77wf-7c6r-cx8j.json create mode 100644 advisories/unreviewed/2025/03/GHSA-g9wm-f4gx-rwmf/GHSA-g9wm-f4gx-rwmf.json diff --git a/advisories/unreviewed/2025/03/GHSA-2r5w-7wp5-72qw/GHSA-2r5w-7wp5-72qw.json b/advisories/unreviewed/2025/03/GHSA-2r5w-7wp5-72qw/GHSA-2r5w-7wp5-72qw.json new file mode 100644 index 00000000000..960dbbd524b --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-2r5w-7wp5-72qw/GHSA-2r5w-7wp5-72qw.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2r5w-7wp5-72qw", + "modified": "2025-03-02T15:30:31Z", + "published": "2025-03-02T15:30:31Z", + "aliases": [ + "CVE-2025-1817" + ], + "details": "A vulnerability classified as problematic was found in Mini-Tmall up to 20250211. This vulnerability affects unknown code of the file /admin of the component Admin Name Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1817" + }, + { + "type": "WEB", + "url": "https://github.com/qkdjksfkeg/cve_article/blob/main/Tmall_demo/XSS.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.298090" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.298090" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.504302" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-02T15:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-73xw-qxgf-j8c4/GHSA-73xw-qxgf-j8c4.json b/advisories/unreviewed/2025/03/GHSA-73xw-qxgf-j8c4/GHSA-73xw-qxgf-j8c4.json new file mode 100644 index 00000000000..e76ad200ad5 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-73xw-qxgf-j8c4/GHSA-73xw-qxgf-j8c4.json @@ -0,0 +1,45 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-73xw-qxgf-j8c4", + "modified": "2025-03-02T15:30:31Z", + "published": "2025-03-02T15:30:31Z", + "aliases": [ + "CVE-2022-49733" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC\n\nThere is a small race window at snd_pcm_oss_sync() that is called from\nOSS PCM SNDCTL_DSP_SYNC ioctl; namely the function calls\nsnd_pcm_oss_make_ready() at first, then takes the params_lock mutex\nfor the rest. When the stream is set up again by another thread\nbetween them, it leads to inconsistency, and may result in unexpected\nresults such as NULL dereference of OSS buffer as a fuzzer spotted\nrecently.\n\nThe fix is simply to cover snd_pcm_oss_make_ready() call into the same\nparams_lock mutex with snd_pcm_oss_make_ready_locked() variant.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49733" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4051324a6dafd7053c74c475e80b3ba10ae672b0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/723ac5ab2891b6c10dd6cc78ef5456af593490eb" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8015ef9e8a0ee5cecfd0cb6805834d007ab26f86" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8423f0b6d513b259fdab9c9bf4aaa6188d054c2d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fce793a056c604b41a298317cf704dae255f1b36" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-02T15:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-77wf-7c6r-cx8j/GHSA-77wf-7c6r-cx8j.json b/advisories/unreviewed/2025/03/GHSA-77wf-7c6r-cx8j/GHSA-77wf-7c6r-cx8j.json new file mode 100644 index 00000000000..fcccf4dd5e3 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-77wf-7c6r-cx8j/GHSA-77wf-7c6r-cx8j.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-77wf-7c6r-cx8j", + "modified": "2025-03-02T15:30:31Z", + "published": "2025-03-02T15:30:31Z", + "aliases": [ + "CVE-2025-1816" + ], + "details": "A vulnerability classified as problematic has been found in FFmpeg up to 6e26f57f672b05e7b8b052007a83aef99dc81ccb. This affects the function audio_element_obu of the file libavformat/iamf_parse.c of the component IAMF File Handler. The manipulation of the argument num_parameters leads to memory leak. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 0526535cd58444dd264e810b2f3348b4d96cff3b. It is recommended to apply a patch to fix this issue.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1816" + }, + { + "type": "WEB", + "url": "https://ffmpeg.org" + }, + { + "type": "WEB", + "url": "https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/0526535cd58444dd264e810b2f3348b4d96cff3b" + }, + { + "type": "WEB", + "url": "https://trac.ffmpeg.org/attachment/ticket/11475/poc" + }, + { + "type": "WEB", + "url": "https://trac.ffmpeg.org/ticket/11475" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.298089" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.298089" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.506575" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-401" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-02T14:15:34Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-g9wm-f4gx-rwmf/GHSA-g9wm-f4gx-rwmf.json b/advisories/unreviewed/2025/03/GHSA-g9wm-f4gx-rwmf/GHSA-g9wm-f4gx-rwmf.json new file mode 100644 index 00000000000..c194ee0e899 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-g9wm-f4gx-rwmf/GHSA-g9wm-f4gx-rwmf.json @@ -0,0 +1,25 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g9wm-f4gx-rwmf", + "modified": "2025-03-02T15:30:30Z", + "published": "2025-03-02T15:30:30Z", + "aliases": [ + "CVE-2022-49045" + ], + "details": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49045" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-26T07:00:41Z" + } +} \ No newline at end of file