Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2025-04-29 21:32:58 +00:00
parent 62a655cbe0
commit 6a7d48605b
70 changed files with 647 additions and 128 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3mh4-fcx6-w55m",
-  "modified": "2022-11-23T21:30:33Z",
+  "modified": "2025-04-29T21:31:29Z",
  "published": "2022-11-22T15:30:25Z",
  "aliases": [
    "CVE-2022-44804"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5q2f-65mc-6jvf",
-  "modified": "2022-11-22T21:30:17Z",
+  "modified": "2025-04-29T21:31:25Z",
  "published": "2022-11-19T00:30:55Z",
  "aliases": [
    "CVE-2021-31739"
@@ -30,6 +30,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-284",
      "CWE-863"
    ],
    "severity": "CRITICAL",
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-69f3-xjq9-mwxg",
-  "modified": "2022-11-23T21:30:33Z",
+  "modified": "2025-04-29T21:31:27Z",
  "published": "2022-11-22T15:30:25Z",
  "aliases": [
    "CVE-2022-44202"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-f6qg-mvmh-xgxv",
-  "modified": "2022-11-23T21:30:33Z",
+  "modified": "2025-04-29T21:31:28Z",
  "published": "2022-11-22T15:30:25Z",
  "aliases": [
    "CVE-2022-44801"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-h558-w3qm-gvh7",
-  "modified": "2022-11-23T21:30:33Z",
+  "modified": "2025-04-29T21:31:29Z",
  "published": "2022-11-22T15:30:25Z",
  "aliases": [
    "CVE-2022-44806"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-hj7c-g88c-mq5v",
-  "modified": "2022-11-22T21:30:17Z",
+  "modified": "2025-04-29T21:31:25Z",
  "published": "2022-11-18T21:30:16Z",
  "aliases": [
    "CVE-2022-44641"
@@ -23,6 +23,10 @@
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00016.html"
    },
+    {
+      "type": "WEB",
+      "url": "https://lists.lavasoftware.org/archives/list/lava-announce%40lists.lavasoftware.org/thread/WHXGQMIZAPW3GCQEXYHC32N2ZAAAIYCY"
+    },
    {
      "type": "WEB",
      "url": "https://lists.lavasoftware.org/archives/list/lava-announce@lists.lavasoftware.org/thread/WHXGQMIZAPW3GCQEXYHC32N2ZAAAIYCY"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-rxv7-j96r-9mj5",
-  "modified": "2022-11-23T21:30:33Z",
+  "modified": "2025-04-29T21:31:30Z",
  "published": "2022-11-22T15:30:25Z",
  "aliases": [
    "CVE-2022-44807"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-whx6-754g-3x5v",
-  "modified": "2022-11-22T21:30:17Z",
+  "modified": "2025-04-29T21:31:25Z",
  "published": "2022-11-19T00:30:55Z",
  "aliases": [
    "CVE-2021-22141"
@@ -25,7 +25,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-400"
+    ],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -33,7 +33,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-863"
+    ],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -26,6 +26,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-120",
      "CWE-787"
    ],
    "severity": "HIGH",
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7cjp-92p9-vr97",
-  "modified": "2023-11-08T21:30:36Z",
+  "modified": "2025-04-29T21:31:30Z",
  "published": "2023-11-01T18:30:33Z",
  "aliases": [
    "CVE-2023-5849"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-c46p-5pq2-qpcg",
-  "modified": "2023-11-08T21:30:36Z",
+  "modified": "2025-04-29T21:31:30Z",
  "published": "2023-11-01T18:30:33Z",
  "aliases": [
    "CVE-2023-5854"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-jwj7-8489-4jqm",
-  "modified": "2023-11-08T21:30:36Z",
+  "modified": "2025-04-29T21:31:30Z",
  "published": "2023-11-01T18:30:33Z",
  "aliases": [
    "CVE-2023-5855"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-qfx8-xprj-wvh4",
-  "modified": "2023-11-08T21:30:36Z",
+  "modified": "2025-04-29T21:31:30Z",
  "published": "2023-11-01T18:30:33Z",
  "aliases": [
    "CVE-2023-5852"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-xmhq-fw78-wjxr",
-  "modified": "2023-11-08T21:30:36Z",
+  "modified": "2025-04-29T21:31:31Z",
  "published": "2023-11-01T18:30:34Z",
  "aliases": [
    "CVE-2023-5856"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3c4w-p6cr-wgq6",
-  "modified": "2024-05-21T15:31:39Z",
+  "modified": "2025-04-29T21:31:31Z",
  "published": "2024-05-21T15:31:39Z",
  "aliases": [
    "CVE-2021-47221"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slub: actually fix freelist pointer vs redzoning\n\nIt turns out that SLUB redzoning (\"slub_debug=Z\") checks from\ns->object_size rather than from s->inuse (which is normally bumped to\nmake room for the freelist pointer), so a cache created with an object\nsize less than 24 would have the freelist pointer written beyond\ns->object_size, causing the redzone to be corrupted by the freelist\npointer.  This was very visible with \"slub_debug=ZF\":\n\n  BUG test (Tainted: G    B            ): Right Redzone overwritten\n  -----------------------------------------------------------------------------\n\n  INFO: 0xffff957ead1c05de-0xffff957ead1c05df @offset=1502. First byte 0x1a instead of 0xbb\n  INFO: Slab 0xffffef3950b47000 objects=170 used=170 fp=0x0000000000000000 flags=0x8000000000000200\n  INFO: Object 0xffff957ead1c05d8 @offset=1496 fp=0xffff957ead1c0620\n\n  Redzone  (____ptrval____): bb bb bb bb bb bb bb bb               ........\n  Object   (____ptrval____): 00 00 00 00 00 f6 f4 a5               ........\n  Redzone  (____ptrval____): 40 1d e8 1a aa                        @....\n  Padding  (____ptrval____): 00 00 00 00 00 00 00 00               ........\n\nAdjust the offset to stay within s->object_size.\n\n(Note that no caches of in this size range are known to exist in the\nkernel currently.)",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -28,8 +33,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-763"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-21T15:15:11Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3w59-vx6f-4274",
-  "modified": "2024-05-21T15:31:40Z",
+  "modified": "2025-04-29T21:31:35Z",
  "published": "2024-05-21T15:31:40Z",
  "aliases": [
    "CVE-2021-47236"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: cdc_eem: fix tx fixup skb leak\n\nwhen usbnet transmit a skb, eem fixup it in eem_tx_fixup(),\nif skb_copy_expand() failed, it return NULL,\nusbnet_start_xmit() will have no chance to free original skb.\n\nfix it by free orginal skb in eem_tx_fixup() first,\nthen check skb clone status, if failed, return NULL to usbnet.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -48,8 +53,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-401"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-21T15:15:12Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-4jxh-jrgp-4422",
-  "modified": "2024-05-21T15:31:39Z",
+  "modified": "2025-04-29T21:31:32Z",
  "published": "2024-05-21T15:31:39Z",
  "aliases": [
    "CVE-2021-47226"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer\n\nBoth Intel and AMD consider it to be architecturally valid for XRSTOR to\nfail with #PF but nonetheless change the register state.  The actual\nconditions under which this might occur are unclear [1], but it seems\nplausible that this might be triggered if one sibling thread unmaps a page\nand invalidates the shared TLB while another sibling thread is executing\nXRSTOR on the page in question.\n\n__fpu__restore_sig() can execute XRSTOR while the hardware registers\nare preserved on behalf of a different victim task (using the\nfpu_fpregs_owner_ctx mechanism), and, in theory, XRSTOR could fail but\nmodify the registers.\n\nIf this happens, then there is a window in which __fpu__restore_sig()\ncould schedule out and the victim task could schedule back in without\nreloading its own FPU registers. This would result in part of the FPU\nstate that __fpu__restore_sig() was attempting to load leaking into the\nvictim task's user-visible state.\n\nInvalidate preserved FPU registers on XRSTOR failure to prevent this\nsituation from corrupting any state.\n\n[1] Frequent readers of the errata lists might imagine \"complex\n    microarchitectural conditions\".",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -28,8 +33,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-203"
+    ],
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-21T15:15:11Z"
--- a/Show More
+++ b/Show More