From 7ed0e5f94a71522da1496483ac39db1f253ffb51 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 14 Mar 2025 21:33:03 +0000 Subject: [PATCH] Advisory Database Sync --- .../GHSA-m2w7-3369-7579.json | 13 +++-- .../GHSA-44fg-4fh7-vvgc.json | 1 + .../GHSA-696f-v7g7-q758.json | 6 ++- .../GHSA-mj78-cj5w-7qvh.json | 2 +- .../GHSA-p25x-ww85-g4gw.json | 2 +- .../GHSA-vm68-972c-j826.json | 2 +- .../GHSA-wqf4-gccr-fcx6.json | 6 ++- .../GHSA-3rqj-8cc4-p9rh.json | 2 +- .../GHSA-c39g-93pm-r85m.json | 4 +- .../GHSA-g3ch-355r-26mp.json | 6 ++- .../GHSA-xr62-xhf5-qw2c.json | 4 +- .../GHSA-m82c-2r7m-qgcj.json | 4 +- .../GHSA-j6hf-8p8x-c2hc.json | 4 +- .../GHSA-7w2g-wqp8-2c9j.json | 2 +- .../GHSA-8qjj-rx3q-j7f8.json | 4 +- .../GHSA-ch4x-f5c4-36gv.json | 3 +- .../GHSA-gv82-rp99-r5wq.json | 10 +++- .../GHSA-jxff-45f6-mfww.json | 4 +- .../GHSA-pmrv-fmw3-5h6p.json | 4 +- .../GHSA-qj89-gqxq-9f84.json | 4 +- .../GHSA-v6r5-wp7h-cj77.json | 4 +- .../GHSA-vcmx-3577-7jh3.json | 4 +- .../GHSA-44pq-qvmw-gj4m.json | 4 +- .../GHSA-4hvh-m426-wv8w.json | 7 ++- .../GHSA-gmvf-rv8w-2hrh.json | 4 +- .../GHSA-76vw-8gm2-pwmh.json | 52 +++++++++++++++++++ .../GHSA-qxwf-xj2v-qm83.json | 52 +++++++++++++++++++ .../GHSA-vf6f-gpmv-93m4.json | 3 +- .../GHSA-vr2r-rp8h-3j86.json | 52 +++++++++++++++++++ .../GHSA-vwg2-4h4c-ch44.json | 48 +++++++++++++++++ 30 files changed, 289 insertions(+), 28 deletions(-) create mode 100644 advisories/unreviewed/2025/03/GHSA-76vw-8gm2-pwmh/GHSA-76vw-8gm2-pwmh.json create mode 100644 advisories/unreviewed/2025/03/GHSA-qxwf-xj2v-qm83/GHSA-qxwf-xj2v-qm83.json create mode 100644 advisories/unreviewed/2025/03/GHSA-vr2r-rp8h-3j86/GHSA-vr2r-rp8h-3j86.json create mode 100644 advisories/unreviewed/2025/03/GHSA-vwg2-4h4c-ch44/GHSA-vwg2-4h4c-ch44.json diff --git a/advisories/unreviewed/2022/05/GHSA-m2w7-3369-7579/GHSA-m2w7-3369-7579.json b/advisories/unreviewed/2022/05/GHSA-m2w7-3369-7579/GHSA-m2w7-3369-7579.json index bf0dfe364a4..171c0d8af59 100644 --- a/advisories/unreviewed/2022/05/GHSA-m2w7-3369-7579/GHSA-m2w7-3369-7579.json +++ b/advisories/unreviewed/2022/05/GHSA-m2w7-3369-7579/GHSA-m2w7-3369-7579.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-m2w7-3369-7579", - "modified": "2022-05-24T22:00:02Z", + "modified": "2025-03-14T21:31:30Z", "published": "2022-05-24T22:00:02Z", "aliases": [ "CVE-2019-12483" ], "details": "An issue was discovered in GPAC 0.7.1. There is a heap-based buffer overflow in the function ReadGF_IPMPX_RemoveToolNotificationListener in odf/ipmpx_code.c in libgpac.a, as demonstrated by MP4Box.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -24,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-787" + ], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2023/02/GHSA-44fg-4fh7-vvgc/GHSA-44fg-4fh7-vvgc.json b/advisories/unreviewed/2023/02/GHSA-44fg-4fh7-vvgc/GHSA-44fg-4fh7-vvgc.json index 6490c188340..37644b2206a 100644 --- a/advisories/unreviewed/2023/02/GHSA-44fg-4fh7-vvgc/GHSA-44fg-4fh7-vvgc.json +++ b/advisories/unreviewed/2023/02/GHSA-44fg-4fh7-vvgc/GHSA-44fg-4fh7-vvgc.json @@ -26,6 +26,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-489", "CWE-89" ], "severity": "CRITICAL", diff --git a/advisories/unreviewed/2023/02/GHSA-696f-v7g7-q758/GHSA-696f-v7g7-q758.json b/advisories/unreviewed/2023/02/GHSA-696f-v7g7-q758/GHSA-696f-v7g7-q758.json index ef94cc258f2..e1281b84db5 100644 --- a/advisories/unreviewed/2023/02/GHSA-696f-v7g7-q758/GHSA-696f-v7g7-q758.json +++ b/advisories/unreviewed/2023/02/GHSA-696f-v7g7-q758/GHSA-696f-v7g7-q758.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-696f-v7g7-q758", - "modified": "2023-02-28T03:30:17Z", + "modified": "2025-03-14T21:31:33Z", "published": "2023-02-21T03:30:19Z", "aliases": [ "CVE-2023-26253" @@ -23,6 +23,10 @@ "type": "WEB", "url": "https://github.com/gluster/glusterfs/issues/3954" }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UE6K2DXP4QZVKP32Z7BSYDSRBL4H7JSE" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UE6K2DXP4QZVKP32Z7BSYDSRBL4H7JSE" diff --git a/advisories/unreviewed/2023/02/GHSA-mj78-cj5w-7qvh/GHSA-mj78-cj5w-7qvh.json b/advisories/unreviewed/2023/02/GHSA-mj78-cj5w-7qvh/GHSA-mj78-cj5w-7qvh.json index 2330b177fc2..ed4dd95cb7e 100644 --- a/advisories/unreviewed/2023/02/GHSA-mj78-cj5w-7qvh/GHSA-mj78-cj5w-7qvh.json +++ b/advisories/unreviewed/2023/02/GHSA-mj78-cj5w-7qvh/GHSA-mj78-cj5w-7qvh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-mj78-cj5w-7qvh", - "modified": "2023-03-03T15:30:20Z", + "modified": "2025-03-14T21:31:33Z", "published": "2023-02-22T00:30:31Z", "aliases": [ "CVE-2023-24080" diff --git a/advisories/unreviewed/2023/02/GHSA-p25x-ww85-g4gw/GHSA-p25x-ww85-g4gw.json b/advisories/unreviewed/2023/02/GHSA-p25x-ww85-g4gw/GHSA-p25x-ww85-g4gw.json index 9e4a9ce542c..56fd2242ec9 100644 --- a/advisories/unreviewed/2023/02/GHSA-p25x-ww85-g4gw/GHSA-p25x-ww85-g4gw.json +++ b/advisories/unreviewed/2023/02/GHSA-p25x-ww85-g4gw/GHSA-p25x-ww85-g4gw.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-p25x-ww85-g4gw", - "modified": "2023-03-03T00:30:45Z", + "modified": "2025-03-14T21:31:33Z", "published": "2023-02-21T21:30:16Z", "aliases": [ "CVE-2022-46637" diff --git a/advisories/unreviewed/2023/02/GHSA-vm68-972c-j826/GHSA-vm68-972c-j826.json b/advisories/unreviewed/2023/02/GHSA-vm68-972c-j826/GHSA-vm68-972c-j826.json index a362f291103..c3f723008ae 100644 --- a/advisories/unreviewed/2023/02/GHSA-vm68-972c-j826/GHSA-vm68-972c-j826.json +++ b/advisories/unreviewed/2023/02/GHSA-vm68-972c-j826/GHSA-vm68-972c-j826.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vm68-972c-j826", - "modified": "2023-03-03T15:30:24Z", + "modified": "2025-03-14T21:31:33Z", "published": "2023-02-22T00:30:31Z", "aliases": [ "CVE-2023-24081" diff --git a/advisories/unreviewed/2023/02/GHSA-wqf4-gccr-fcx6/GHSA-wqf4-gccr-fcx6.json b/advisories/unreviewed/2023/02/GHSA-wqf4-gccr-fcx6/GHSA-wqf4-gccr-fcx6.json index c9a226953fa..c7441734c36 100644 --- a/advisories/unreviewed/2023/02/GHSA-wqf4-gccr-fcx6/GHSA-wqf4-gccr-fcx6.json +++ b/advisories/unreviewed/2023/02/GHSA-wqf4-gccr-fcx6/GHSA-wqf4-gccr-fcx6.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wqf4-gccr-fcx6", - "modified": "2023-02-28T03:30:17Z", + "modified": "2025-03-14T21:31:33Z", "published": "2023-02-21T03:30:19Z", "aliases": [ "CVE-2022-48340" @@ -23,6 +23,10 @@ "type": "WEB", "url": "https://github.com/gluster/glusterfs/issues/3732" }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UE6K2DXP4QZVKP32Z7BSYDSRBL4H7JSE" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UE6K2DXP4QZVKP32Z7BSYDSRBL4H7JSE" diff --git a/advisories/unreviewed/2023/05/GHSA-3rqj-8cc4-p9rh/GHSA-3rqj-8cc4-p9rh.json b/advisories/unreviewed/2023/05/GHSA-3rqj-8cc4-p9rh/GHSA-3rqj-8cc4-p9rh.json index 32eff88568c..2b42717dffb 100644 --- a/advisories/unreviewed/2023/05/GHSA-3rqj-8cc4-p9rh/GHSA-3rqj-8cc4-p9rh.json +++ b/advisories/unreviewed/2023/05/GHSA-3rqj-8cc4-p9rh/GHSA-3rqj-8cc4-p9rh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3rqj-8cc4-p9rh", - "modified": "2024-01-09T03:30:21Z", + "modified": "2025-03-14T21:31:34Z", "published": "2023-05-19T15:30:20Z", "aliases": [ "CVE-2023-30774" diff --git a/advisories/unreviewed/2024/03/GHSA-c39g-93pm-r85m/GHSA-c39g-93pm-r85m.json b/advisories/unreviewed/2024/03/GHSA-c39g-93pm-r85m/GHSA-c39g-93pm-r85m.json index fbe297f2565..ebc9873dda4 100644 --- a/advisories/unreviewed/2024/03/GHSA-c39g-93pm-r85m/GHSA-c39g-93pm-r85m.json +++ b/advisories/unreviewed/2024/03/GHSA-c39g-93pm-r85m/GHSA-c39g-93pm-r85m.json @@ -33,7 +33,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-347" + ], "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/03/GHSA-g3ch-355r-26mp/GHSA-g3ch-355r-26mp.json b/advisories/unreviewed/2024/03/GHSA-g3ch-355r-26mp/GHSA-g3ch-355r-26mp.json index 49801439731..1ff11caa9a5 100644 --- a/advisories/unreviewed/2024/03/GHSA-g3ch-355r-26mp/GHSA-g3ch-355r-26mp.json +++ b/advisories/unreviewed/2024/03/GHSA-g3ch-355r-26mp/GHSA-g3ch-355r-26mp.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-g3ch-355r-26mp", - "modified": "2024-11-06T18:31:03Z", + "modified": "2025-03-14T21:31:34Z", "published": "2024-03-06T09:30:26Z", "aliases": [ "CVE-2023-52585" @@ -50,6 +50,10 @@ { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html" + }, + { + "type": "WEB", + "url": "https://security.netapp.com/advisory/ntap-20240912-0009" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/03/GHSA-xr62-xhf5-qw2c/GHSA-xr62-xhf5-qw2c.json b/advisories/unreviewed/2024/03/GHSA-xr62-xhf5-qw2c/GHSA-xr62-xhf5-qw2c.json index 8b487a7a7ce..f2243c1160d 100644 --- a/advisories/unreviewed/2024/03/GHSA-xr62-xhf5-qw2c/GHSA-xr62-xhf5-qw2c.json +++ b/advisories/unreviewed/2024/03/GHSA-xr62-xhf5-qw2c/GHSA-xr62-xhf5-qw2c.json @@ -45,7 +45,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-356" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/05/GHSA-m82c-2r7m-qgcj/GHSA-m82c-2r7m-qgcj.json b/advisories/unreviewed/2024/05/GHSA-m82c-2r7m-qgcj/GHSA-m82c-2r7m-qgcj.json index b729db823d9..53a56ab7f12 100644 --- a/advisories/unreviewed/2024/05/GHSA-m82c-2r7m-qgcj/GHSA-m82c-2r7m-qgcj.json +++ b/advisories/unreviewed/2024/05/GHSA-m82c-2r7m-qgcj/GHSA-m82c-2r7m-qgcj.json @@ -41,7 +41,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-20" + ], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/06/GHSA-j6hf-8p8x-c2hc/GHSA-j6hf-8p8x-c2hc.json b/advisories/unreviewed/2024/06/GHSA-j6hf-8p8x-c2hc/GHSA-j6hf-8p8x-c2hc.json index ad4eb52a41d..3a6578abdc7 100644 --- a/advisories/unreviewed/2024/06/GHSA-j6hf-8p8x-c2hc/GHSA-j6hf-8p8x-c2hc.json +++ b/advisories/unreviewed/2024/06/GHSA-j6hf-8p8x-c2hc/GHSA-j6hf-8p8x-c2hc.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-284" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/07/GHSA-7w2g-wqp8-2c9j/GHSA-7w2g-wqp8-2c9j.json b/advisories/unreviewed/2024/07/GHSA-7w2g-wqp8-2c9j/GHSA-7w2g-wqp8-2c9j.json index 8959f2f033d..991890cb12d 100644 --- a/advisories/unreviewed/2024/07/GHSA-7w2g-wqp8-2c9j/GHSA-7w2g-wqp8-2c9j.json +++ b/advisories/unreviewed/2024/07/GHSA-7w2g-wqp8-2c9j/GHSA-7w2g-wqp8-2c9j.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7w2g-wqp8-2c9j", - "modified": "2024-07-12T18:31:47Z", + "modified": "2025-03-14T21:31:39Z", "published": "2024-07-11T06:30:36Z", "aliases": [ "CVE-2024-22280" diff --git a/advisories/unreviewed/2024/07/GHSA-8qjj-rx3q-j7f8/GHSA-8qjj-rx3q-j7f8.json b/advisories/unreviewed/2024/07/GHSA-8qjj-rx3q-j7f8/GHSA-8qjj-rx3q-j7f8.json index 7227b8c8721..0e27b7ed548 100644 --- a/advisories/unreviewed/2024/07/GHSA-8qjj-rx3q-j7f8/GHSA-8qjj-rx3q-j7f8.json +++ b/advisories/unreviewed/2024/07/GHSA-8qjj-rx3q-j7f8/GHSA-8qjj-rx3q-j7f8.json @@ -53,7 +53,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-416" + ], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/07/GHSA-ch4x-f5c4-36gv/GHSA-ch4x-f5c4-36gv.json b/advisories/unreviewed/2024/07/GHSA-ch4x-f5c4-36gv/GHSA-ch4x-f5c4-36gv.json index eb2e2ccc0bb..f5c93ea4496 100644 --- a/advisories/unreviewed/2024/07/GHSA-ch4x-f5c4-36gv/GHSA-ch4x-f5c4-36gv.json +++ b/advisories/unreviewed/2024/07/GHSA-ch4x-f5c4-36gv/GHSA-ch4x-f5c4-36gv.json @@ -38,7 +38,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-284" + "CWE-284", + "CWE-94" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/07/GHSA-gv82-rp99-r5wq/GHSA-gv82-rp99-r5wq.json b/advisories/unreviewed/2024/07/GHSA-gv82-rp99-r5wq/GHSA-gv82-rp99-r5wq.json index a4d576b4322..043feb010f2 100644 --- a/advisories/unreviewed/2024/07/GHSA-gv82-rp99-r5wq/GHSA-gv82-rp99-r5wq.json +++ b/advisories/unreviewed/2024/07/GHSA-gv82-rp99-r5wq/GHSA-gv82-rp99-r5wq.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-gv82-rp99-r5wq", - "modified": "2024-07-17T00:32:54Z", + "modified": "2025-03-14T21:31:39Z", "published": "2024-07-17T00:32:54Z", "aliases": [ "CVE-2024-21137" @@ -19,13 +19,19 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21137" }, + { + "type": "WEB", + "url": "https://security.netapp.com/advisory/ntap-20240731-0009" + }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujul2024.html" } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-285" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/07/GHSA-jxff-45f6-mfww/GHSA-jxff-45f6-mfww.json b/advisories/unreviewed/2024/07/GHSA-jxff-45f6-mfww/GHSA-jxff-45f6-mfww.json index 804575995f9..310c6b7ea18 100644 --- a/advisories/unreviewed/2024/07/GHSA-jxff-45f6-mfww/GHSA-jxff-45f6-mfww.json +++ b/advisories/unreviewed/2024/07/GHSA-jxff-45f6-mfww/GHSA-jxff-45f6-mfww.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-285" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/07/GHSA-pmrv-fmw3-5h6p/GHSA-pmrv-fmw3-5h6p.json b/advisories/unreviewed/2024/07/GHSA-pmrv-fmw3-5h6p/GHSA-pmrv-fmw3-5h6p.json index eece4209b10..1d916188b41 100644 --- a/advisories/unreviewed/2024/07/GHSA-pmrv-fmw3-5h6p/GHSA-pmrv-fmw3-5h6p.json +++ b/advisories/unreviewed/2024/07/GHSA-pmrv-fmw3-5h6p/GHSA-pmrv-fmw3-5h6p.json @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-61" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/07/GHSA-qj89-gqxq-9f84/GHSA-qj89-gqxq-9f84.json b/advisories/unreviewed/2024/07/GHSA-qj89-gqxq-9f84/GHSA-qj89-gqxq-9f84.json index 2168f9261e1..e0742250a96 100644 --- a/advisories/unreviewed/2024/07/GHSA-qj89-gqxq-9f84/GHSA-qj89-gqxq-9f84.json +++ b/advisories/unreviewed/2024/07/GHSA-qj89-gqxq-9f84/GHSA-qj89-gqxq-9f84.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-285" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/07/GHSA-v6r5-wp7h-cj77/GHSA-v6r5-wp7h-cj77.json b/advisories/unreviewed/2024/07/GHSA-v6r5-wp7h-cj77/GHSA-v6r5-wp7h-cj77.json index aa2af2eaf0e..fd7b5a6ac39 100644 --- a/advisories/unreviewed/2024/07/GHSA-v6r5-wp7h-cj77/GHSA-v6r5-wp7h-cj77.json +++ b/advisories/unreviewed/2024/07/GHSA-v6r5-wp7h-cj77/GHSA-v6r5-wp7h-cj77.json @@ -41,7 +41,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-94" + ], "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/07/GHSA-vcmx-3577-7jh3/GHSA-vcmx-3577-7jh3.json b/advisories/unreviewed/2024/07/GHSA-vcmx-3577-7jh3/GHSA-vcmx-3577-7jh3.json index 05f1f14779e..03678cddfca 100644 --- a/advisories/unreviewed/2024/07/GHSA-vcmx-3577-7jh3/GHSA-vcmx-3577-7jh3.json +++ b/advisories/unreviewed/2024/07/GHSA-vcmx-3577-7jh3/GHSA-vcmx-3577-7jh3.json @@ -45,7 +45,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-287" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/08/GHSA-44pq-qvmw-gj4m/GHSA-44pq-qvmw-gj4m.json b/advisories/unreviewed/2024/08/GHSA-44pq-qvmw-gj4m/GHSA-44pq-qvmw-gj4m.json index b2041db276e..d9026322166 100644 --- a/advisories/unreviewed/2024/08/GHSA-44pq-qvmw-gj4m/GHSA-44pq-qvmw-gj4m.json +++ b/advisories/unreviewed/2024/08/GHSA-44pq-qvmw-gj4m/GHSA-44pq-qvmw-gj4m.json @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-200" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/08/GHSA-4hvh-m426-wv8w/GHSA-4hvh-m426-wv8w.json b/advisories/unreviewed/2024/08/GHSA-4hvh-m426-wv8w/GHSA-4hvh-m426-wv8w.json index 745bc521686..6d96d30aba9 100644 --- a/advisories/unreviewed/2024/08/GHSA-4hvh-m426-wv8w/GHSA-4hvh-m426-wv8w.json +++ b/advisories/unreviewed/2024/08/GHSA-4hvh-m426-wv8w/GHSA-4hvh-m426-wv8w.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4hvh-m426-wv8w", - "modified": "2024-08-30T21:31:40Z", + "modified": "2025-03-14T21:31:40Z", "published": "2024-08-30T03:30:44Z", "aliases": [ "CVE-2024-45490" @@ -26,10 +26,15 @@ { "type": "WEB", "url": "https://github.com/libexpat/libexpat/pull/890" + }, + { + "type": "WEB", + "url": "https://security.netapp.com/advisory/ntap-20241018-0004" } ], "database_specific": { "cwe_ids": [ + "CWE-190", "CWE-611" ], "severity": "CRITICAL", diff --git a/advisories/unreviewed/2024/09/GHSA-gmvf-rv8w-2hrh/GHSA-gmvf-rv8w-2hrh.json b/advisories/unreviewed/2024/09/GHSA-gmvf-rv8w-2hrh/GHSA-gmvf-rv8w-2hrh.json index 7c4029bd977..17e296c8bb3 100644 --- a/advisories/unreviewed/2024/09/GHSA-gmvf-rv8w-2hrh/GHSA-gmvf-rv8w-2hrh.json +++ b/advisories/unreviewed/2024/09/GHSA-gmvf-rv8w-2hrh/GHSA-gmvf-rv8w-2hrh.json @@ -45,7 +45,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-835" + ], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2025/03/GHSA-76vw-8gm2-pwmh/GHSA-76vw-8gm2-pwmh.json b/advisories/unreviewed/2025/03/GHSA-76vw-8gm2-pwmh/GHSA-76vw-8gm2-pwmh.json new file mode 100644 index 00000000000..4460f9d53b6 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-76vw-8gm2-pwmh/GHSA-76vw-8gm2-pwmh.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-76vw-8gm2-pwmh", + "modified": "2025-03-14T21:31:40Z", + "published": "2025-03-14T21:31:40Z", + "aliases": [ + "CVE-2025-2309" + ], + "details": "A vulnerability has been found in HDF5 1.14.6 and classified as critical. This vulnerability affects the function H5T__bit_copy of the component Type Conversion Logic. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor was contacted early about a batch of vulnerabilities. His response was \"reject\" without further explanation. We have not received an elaboration even after asking politely for further details. Currently we assume that the vendor wants to \"dispute\" the entries which is why they are flagged as such until further details become available.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2309" + }, + { + "type": "WEB", + "url": "https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc3.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.299722" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.299722" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.514532" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-14T21:15:37Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-qxwf-xj2v-qm83/GHSA-qxwf-xj2v-qm83.json b/advisories/unreviewed/2025/03/GHSA-qxwf-xj2v-qm83/GHSA-qxwf-xj2v-qm83.json new file mode 100644 index 00000000000..790f013d833 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-qxwf-xj2v-qm83/GHSA-qxwf-xj2v-qm83.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qxwf-xj2v-qm83", + "modified": "2025-03-14T21:31:40Z", + "published": "2025-03-14T21:31:40Z", + "aliases": [ + "CVE-2025-2310" + ], + "details": "A vulnerability was found in HDF5 1.14.6 and classified as critical. This issue affects the function H5MM_strndup of the component Metadata Attribute Decoder. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor was contacted early about a batch of vulnerabilities. His response was \"reject\" without further explanation. We have not received an elaboration even after asking politely for further details. Currently we assume that the vendor wants to \"dispute\" the entries which is why they are flagged as such until further details become available.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2310" + }, + { + "type": "WEB", + "url": "https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc4.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.299723" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.299723" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.514533" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-14T21:15:37Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-vf6f-gpmv-93m4/GHSA-vf6f-gpmv-93m4.json b/advisories/unreviewed/2025/03/GHSA-vf6f-gpmv-93m4/GHSA-vf6f-gpmv-93m4.json index 9792126ce0f..50a3d6b324b 100644 --- a/advisories/unreviewed/2025/03/GHSA-vf6f-gpmv-93m4/GHSA-vf6f-gpmv-93m4.json +++ b/advisories/unreviewed/2025/03/GHSA-vf6f-gpmv-93m4/GHSA-vf6f-gpmv-93m4.json @@ -26,7 +26,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-122" + "CWE-122", + "CWE-190" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/03/GHSA-vr2r-rp8h-3j86/GHSA-vr2r-rp8h-3j86.json b/advisories/unreviewed/2025/03/GHSA-vr2r-rp8h-3j86/GHSA-vr2r-rp8h-3j86.json new file mode 100644 index 00000000000..9a390178076 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-vr2r-rp8h-3j86/GHSA-vr2r-rp8h-3j86.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vr2r-rp8h-3j86", + "modified": "2025-03-14T21:31:40Z", + "published": "2025-03-14T21:31:40Z", + "aliases": [ + "CVE-2025-2308" + ], + "details": "A vulnerability, which was classified as critical, was found in HDF5 1.14.6. This affects the function H5Z__scaleoffset_decompress_one_byte of the component Scale-Offset Filter. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor was contacted early about a batch of vulnerabilities. His response was \"reject\" without further explanation. We have not received an elaboration even after asking politely for further details. Currently we assume that the vendor wants to \"dispute\" the entries which is why they are flagged as such until further details become available.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2308" + }, + { + "type": "WEB", + "url": "https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc2.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.299721" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.299721" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.514531" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-14T21:15:37Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-vwg2-4h4c-ch44/GHSA-vwg2-4h4c-ch44.json b/advisories/unreviewed/2025/03/GHSA-vwg2-4h4c-ch44/GHSA-vwg2-4h4c-ch44.json new file mode 100644 index 00000000000..61ec8b1b56c --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-vwg2-4h4c-ch44/GHSA-vwg2-4h4c-ch44.json @@ -0,0 +1,48 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vwg2-4h4c-ch44", + "modified": "2025-03-14T21:31:40Z", + "published": "2025-03-14T21:31:40Z", + "aliases": [ + "CVE-2022-49187" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: Fix clk_hw_get_clk() when dev is NULL\n\nAny registered clk_core structure can have a NULL pointer in its dev\nfield. While never actually documented, this is evidenced by the wide\nusage of clk_register and clk_hw_register with a NULL device pointer,\nand the fact that the core of_clk_hw_register() function also passes a\nNULL device pointer.\n\nA call to clk_hw_get_clk() on a clk_hw struct whose clk_core is in that\ncase will result in a NULL pointer derefence when it calls dev_name() on\nthat NULL device pointer.\n\nAdd a test for this case and use NULL as the dev_id if the device\npointer is NULL.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49187" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/0c1b56df451716ba207bbf59f303473643eee4fd" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/23f89fe005b105f0dcc55034c13eb89f9b570fac" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4be3e4c05d8dd1b83b75652cad88c9e752ec7054" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d183f20cf5a7b546d4108e796b98210ceb317579" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-476" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-26T07:00:55Z" + } +} \ No newline at end of file