From 8eb5a45dfe038fdf9e14946dd42340e803c82652 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 2 Dec 2024 09:41:07 +0000 Subject: [PATCH] Publish Advisories GHSA-2r6r-v6fp-6x6r GHSA-7qch-65fq-c3xh GHSA-9r3r-9pph-j34p GHSA-v94w-hwf5-4rj5 GHSA-2hgc-w527-6cxw GHSA-35qp-2m3w-q656 GHSA-66hj-w2gx-rg6c GHSA-87f6-7cww-rh98 GHSA-4qjr-33fg-w8xw GHSA-wxc5-fq68-h9mh GHSA-4xwj-gw53-4w3v GHSA-4f73-836m-4mcr GHSA-8c3c-gvf8-p7v2 GHSA-9fm7-prpc-h7x8 GHSA-pmfq-rg8w-w57m GHSA-w8mg-g59g-ww6x GHSA-x9gg-ww2m-r7gj GHSA-3r56-5r55-j5mh GHSA-fg92-6xpx-v2x4 GHSA-m934-94j6-4844 --- .../GHSA-2r6r-v6fp-6x6r.json | 18 +++--- .../GHSA-7qch-65fq-c3xh.json | 6 +- .../GHSA-9r3r-9pph-j34p.json | 18 +++--- .../GHSA-v94w-hwf5-4rj5.json | 6 +- .../GHSA-2hgc-w527-6cxw.json | 10 +-- .../GHSA-35qp-2m3w-q656.json | 6 +- .../GHSA-66hj-w2gx-rg6c.json | 6 +- .../GHSA-87f6-7cww-rh98.json | 6 +- .../GHSA-4qjr-33fg-w8xw.json | 18 +++--- .../GHSA-wxc5-fq68-h9mh.json | 6 +- .../GHSA-4xwj-gw53-4w3v.json | 10 ++- .../GHSA-4f73-836m-4mcr.json | 18 +++--- .../GHSA-8c3c-gvf8-p7v2.json | 6 +- .../GHSA-9fm7-prpc-h7x8.json | 10 +-- .../GHSA-pmfq-rg8w-w57m.json | 22 ++++--- .../GHSA-w8mg-g59g-ww6x.json | 14 ++--- .../GHSA-x9gg-ww2m-r7gj.json | 14 +++-- .../GHSA-3r56-5r55-j5mh.json | 36 +++++++++++ .../GHSA-fg92-6xpx-v2x4.json | 61 +++++++++++++++++++ .../GHSA-m934-94j6-4844.json | 61 +++++++++++++++++++ 20 files changed, 278 insertions(+), 74 deletions(-) create mode 100644 advisories/unreviewed/2024/12/GHSA-3r56-5r55-j5mh/GHSA-3r56-5r55-j5mh.json create mode 100644 advisories/unreviewed/2024/12/GHSA-fg92-6xpx-v2x4/GHSA-fg92-6xpx-v2x4.json create mode 100644 advisories/unreviewed/2024/12/GHSA-m934-94j6-4844/GHSA-m934-94j6-4844.json diff --git a/advisories/unreviewed/2024/05/GHSA-2r6r-v6fp-6x6r/GHSA-2r6r-v6fp-6x6r.json b/advisories/unreviewed/2024/05/GHSA-2r6r-v6fp-6x6r/GHSA-2r6r-v6fp-6x6r.json index cdc23c72575..0ab79ecc421 100644 --- a/advisories/unreviewed/2024/05/GHSA-2r6r-v6fp-6x6r/GHSA-2r6r-v6fp-6x6r.json +++ b/advisories/unreviewed/2024/05/GHSA-2r6r-v6fp-6x6r/GHSA-2r6r-v6fp-6x6r.json @@ -1,18 +1,14 @@ { "schema_version": "1.4.0", "id": "GHSA-2r6r-v6fp-6x6r", - "modified": "2024-05-21T18:31:21Z", + "modified": "2024-12-02T09:39:11Z", "published": "2024-05-21T18:31:21Z", "aliases": [ "CVE-2023-52812" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd: check num of link levels when update pcie param\n\nIn SR-IOV environment, the value of pcie_table->num_of_link_levels will\nbe 0, and num_of_levels - 1 will cause array index out of bounds", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -22,6 +18,10 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/09f617219fe9ccd8d7b65dc3e879b5889f663b5a" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2f2d48b6247ae3001f83c98730b3cce475cb2927" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/406e8845356d18bdf3d3a23b347faf67706472ec" @@ -32,9 +32,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": null, "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/05/GHSA-7qch-65fq-c3xh/GHSA-7qch-65fq-c3xh.json b/advisories/unreviewed/2024/05/GHSA-7qch-65fq-c3xh/GHSA-7qch-65fq-c3xh.json index e6b0a94d35b..a1fcce00fed 100644 --- a/advisories/unreviewed/2024/05/GHSA-7qch-65fq-c3xh/GHSA-7qch-65fq-c3xh.json +++ b/advisories/unreviewed/2024/05/GHSA-7qch-65fq-c3xh/GHSA-7qch-65fq-c3xh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7qch-65fq-c3xh", - "modified": "2024-06-03T18:55:51Z", + "modified": "2024-12-02T09:39:11Z", "published": "2024-05-01T06:31:41Z", "aliases": [ "CVE-2024-26952" @@ -31,6 +31,10 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/39bdc4197acf2ed13269167ccf093ee28cfa2a4e" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ad6480c9a5d884e2704adc51d69895d93339176c" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/c6cd2e8d2d9aa7ee35b1fa6a668e32a22a9753da" diff --git a/advisories/unreviewed/2024/05/GHSA-9r3r-9pph-j34p/GHSA-9r3r-9pph-j34p.json b/advisories/unreviewed/2024/05/GHSA-9r3r-9pph-j34p/GHSA-9r3r-9pph-j34p.json index d4c54045caa..6a3a5185942 100644 --- a/advisories/unreviewed/2024/05/GHSA-9r3r-9pph-j34p/GHSA-9r3r-9pph-j34p.json +++ b/advisories/unreviewed/2024/05/GHSA-9r3r-9pph-j34p/GHSA-9r3r-9pph-j34p.json @@ -1,18 +1,14 @@ { "schema_version": "1.4.0", "id": "GHSA-9r3r-9pph-j34p", - "modified": "2024-05-01T06:31:42Z", + "modified": "2024-12-02T09:39:11Z", "published": "2024-05-01T06:31:42Z", "aliases": [ "CVE-2024-26954" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()\n\nIf ->NameOffset of smb2_create_req is smaller than Buffer offset of\nsmb2_create_req, slab-out-of-bounds read can happen from smb2_open.\nThis patch set the minimum value of the name offset to the buffer offset\nto validate name length of smb2_create_req().", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -29,12 +25,14 @@ { "type": "WEB", "url": "https://git.kernel.org/stable/c/a80a486d72e20bd12c335bcd38b6e6f19356b0aa" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d70c2e0904ab3715c5673fd45788a464a246d1db" } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": null, "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/05/GHSA-v94w-hwf5-4rj5/GHSA-v94w-hwf5-4rj5.json b/advisories/unreviewed/2024/05/GHSA-v94w-hwf5-4rj5/GHSA-v94w-hwf5-4rj5.json index c83ce413056..4b84b890ff3 100644 --- a/advisories/unreviewed/2024/05/GHSA-v94w-hwf5-4rj5/GHSA-v94w-hwf5-4rj5.json +++ b/advisories/unreviewed/2024/05/GHSA-v94w-hwf5-4rj5/GHSA-v94w-hwf5-4rj5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-v94w-hwf5-4rj5", - "modified": "2024-10-10T12:31:11Z", + "modified": "2024-12-02T09:39:11Z", "published": "2024-05-20T12:30:28Z", "aliases": [ "CVE-2024-35964" @@ -25,6 +25,10 @@ { "type": "WEB", "url": "https://git.kernel.org/stable/c/9e8742cdfc4b0e65266bb4a901a19462bda9285e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/cec736e60dc18d91b88af28d96664bff284b02d1" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/06/GHSA-2hgc-w527-6cxw/GHSA-2hgc-w527-6cxw.json b/advisories/unreviewed/2024/06/GHSA-2hgc-w527-6cxw/GHSA-2hgc-w527-6cxw.json index f1e2aacef72..64b88f81bb2 100644 --- a/advisories/unreviewed/2024/06/GHSA-2hgc-w527-6cxw/GHSA-2hgc-w527-6cxw.json +++ b/advisories/unreviewed/2024/06/GHSA-2hgc-w527-6cxw/GHSA-2hgc-w527-6cxw.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-2hgc-w527-6cxw", - "modified": "2024-08-27T21:31:12Z", + "modified": "2024-12-02T09:39:11Z", "published": "2024-06-19T15:30:53Z", "aliases": [ "CVE-2024-38553" @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -36,6 +34,10 @@ { "type": "WEB", "url": "https://git.kernel.org/stable/c/d38625f71950e79e254515c5fc585552dad4b33e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e2348d8c61d03feece1de4c05f72e6e99f74c650" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/06/GHSA-35qp-2m3w-q656/GHSA-35qp-2m3w-q656.json b/advisories/unreviewed/2024/06/GHSA-35qp-2m3w-q656/GHSA-35qp-2m3w-q656.json index 73c959d7523..3b1e0082c27 100644 --- a/advisories/unreviewed/2024/06/GHSA-35qp-2m3w-q656/GHSA-35qp-2m3w-q656.json +++ b/advisories/unreviewed/2024/06/GHSA-35qp-2m3w-q656/GHSA-35qp-2m3w-q656.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-35qp-2m3w-q656", - "modified": "2024-06-21T12:31:19Z", + "modified": "2024-12-02T09:39:11Z", "published": "2024-06-21T12:31:19Z", "aliases": [ "CVE-2024-36244" @@ -14,6 +14,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36244" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/34d83c3e6e97867ae061d14eb52123404aab1cbc" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/91f249b01fe490fce11fbb4307952ca8cce78724" diff --git a/advisories/unreviewed/2024/06/GHSA-66hj-w2gx-rg6c/GHSA-66hj-w2gx-rg6c.json b/advisories/unreviewed/2024/06/GHSA-66hj-w2gx-rg6c/GHSA-66hj-w2gx-rg6c.json index 495aa4ad220..0c6d71bd109 100644 --- a/advisories/unreviewed/2024/06/GHSA-66hj-w2gx-rg6c/GHSA-66hj-w2gx-rg6c.json +++ b/advisories/unreviewed/2024/06/GHSA-66hj-w2gx-rg6c/GHSA-66hj-w2gx-rg6c.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-66hj-w2gx-rg6c", - "modified": "2024-10-10T12:31:11Z", + "modified": "2024-12-02T09:39:11Z", "published": "2024-06-21T12:31:20Z", "aliases": [ "CVE-2024-36478" @@ -19,6 +19,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36478" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1d4c8baef435c98e8d5aa7027dc5a9f70834ba16" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/5d0495473ee4c1d041b5a917f10446a22c047f47" diff --git a/advisories/unreviewed/2024/07/GHSA-87f6-7cww-rh98/GHSA-87f6-7cww-rh98.json b/advisories/unreviewed/2024/07/GHSA-87f6-7cww-rh98/GHSA-87f6-7cww-rh98.json index 4441bbd4765..f97c8fd9924 100644 --- a/advisories/unreviewed/2024/07/GHSA-87f6-7cww-rh98/GHSA-87f6-7cww-rh98.json +++ b/advisories/unreviewed/2024/07/GHSA-87f6-7cww-rh98/GHSA-87f6-7cww-rh98.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-87f6-7cww-rh98", - "modified": "2024-07-30T09:32:01Z", + "modified": "2024-12-02T09:39:11Z", "published": "2024-07-30T09:32:01Z", "aliases": [ "CVE-2024-42129" @@ -14,6 +14,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42129" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/172ffd26a5af13e951d0e82df7cfc5a95b04fa80" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/3b62888307ae44b68512d3f7735c26a4c8e45b51" diff --git a/advisories/unreviewed/2024/08/GHSA-4qjr-33fg-w8xw/GHSA-4qjr-33fg-w8xw.json b/advisories/unreviewed/2024/08/GHSA-4qjr-33fg-w8xw/GHSA-4qjr-33fg-w8xw.json index aa7c7956b54..f08f7da73e9 100644 --- a/advisories/unreviewed/2024/08/GHSA-4qjr-33fg-w8xw/GHSA-4qjr-33fg-w8xw.json +++ b/advisories/unreviewed/2024/08/GHSA-4qjr-33fg-w8xw/GHSA-4qjr-33fg-w8xw.json @@ -1,18 +1,14 @@ { "schema_version": "1.4.0", "id": "GHSA-4qjr-33fg-w8xw", - "modified": "2024-08-17T09:30:25Z", + "modified": "2024-12-02T09:39:12Z", "published": "2024-08-17T09:30:25Z", "aliases": [ "CVE-2024-42322" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: properly dereference pe in ip_vs_add_service\n\nUse pe directly to resolve sparse warning:\n\n net/netfilter/ipvs/ip_vs_ctl.c:1471:27: warning: dereference of noderef expression", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -22,6 +18,10 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/3dd428039e06e1967ce294e2cd6342825aaaad77" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b2c664df3bb46aabac6a5fd78aaa5bd614cfad97" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/c420cd5d5bc6797f3a8824e7d74f38f0c286fca5" @@ -32,9 +32,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": null, "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/09/GHSA-wxc5-fq68-h9mh/GHSA-wxc5-fq68-h9mh.json b/advisories/unreviewed/2024/09/GHSA-wxc5-fq68-h9mh/GHSA-wxc5-fq68-h9mh.json index d45bb1599dd..0e70d526045 100644 --- a/advisories/unreviewed/2024/09/GHSA-wxc5-fq68-h9mh/GHSA-wxc5-fq68-h9mh.json +++ b/advisories/unreviewed/2024/09/GHSA-wxc5-fq68-h9mh/GHSA-wxc5-fq68-h9mh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wxc5-fq68-h9mh", - "modified": "2024-10-09T15:32:18Z", + "modified": "2024-12-02T09:39:12Z", "published": "2024-09-04T21:30:31Z", "aliases": [ "CVE-2024-44949" @@ -19,6 +19,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44949" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/00baca74fb5879e5f9034b6156671301f500f8ee" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/533de2f470baac40d3bf622fe631f15231a03c9f" diff --git a/advisories/unreviewed/2024/10/GHSA-4xwj-gw53-4w3v/GHSA-4xwj-gw53-4w3v.json b/advisories/unreviewed/2024/10/GHSA-4xwj-gw53-4w3v/GHSA-4xwj-gw53-4w3v.json index 67d78855238..6cccb4fafbf 100644 --- a/advisories/unreviewed/2024/10/GHSA-4xwj-gw53-4w3v/GHSA-4xwj-gw53-4w3v.json +++ b/advisories/unreviewed/2024/10/GHSA-4xwj-gw53-4w3v/GHSA-4xwj-gw53-4w3v.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4xwj-gw53-4w3v", - "modified": "2024-11-01T18:31:26Z", + "modified": "2024-12-02T09:39:12Z", "published": "2024-10-21T18:30:59Z", "aliases": [ "CVE-2024-49974" @@ -23,10 +23,18 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/6a488ad7745b8f64625c6d3a24ce7e448e83f11b" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7ea9260874b779637aff6d24c344b8ef4ac862a0" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/aadc3bbea163b6caaaebfdd2b6c4667fbc726752" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ae267989b7b7933dfedcd26468d0a88fc3a9da9e" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/b4e21431a0db4854b5023cd5af001be557e6c3db" diff --git a/advisories/unreviewed/2024/11/GHSA-4f73-836m-4mcr/GHSA-4f73-836m-4mcr.json b/advisories/unreviewed/2024/11/GHSA-4f73-836m-4mcr/GHSA-4f73-836m-4mcr.json index 9fd4cb2f4de..6a7ea6f69f2 100644 --- a/advisories/unreviewed/2024/11/GHSA-4f73-836m-4mcr/GHSA-4f73-836m-4mcr.json +++ b/advisories/unreviewed/2024/11/GHSA-4f73-836m-4mcr/GHSA-4f73-836m-4mcr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4f73-836m-4mcr", - "modified": "2024-11-25T21:30:49Z", + "modified": "2024-12-02T09:39:12Z", "published": "2024-11-19T18:31:07Z", "aliases": [ "CVE-2024-53073" @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -28,12 +26,18 @@ { "type": "WEB", "url": "https://git.kernel.org/stable/c/8286f8b622990194207df9ab852e0f87c60d35e9" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/949ee5d44d1fd95119b29b3382a933cdc617bf9e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fb79d68a36e21960341ccab07d1ac06d93830321" } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/11/GHSA-8c3c-gvf8-p7v2/GHSA-8c3c-gvf8-p7v2.json b/advisories/unreviewed/2024/11/GHSA-8c3c-gvf8-p7v2/GHSA-8c3c-gvf8-p7v2.json index 4e89162f5ad..aa8e3334939 100644 --- a/advisories/unreviewed/2024/11/GHSA-8c3c-gvf8-p7v2/GHSA-8c3c-gvf8-p7v2.json +++ b/advisories/unreviewed/2024/11/GHSA-8c3c-gvf8-p7v2/GHSA-8c3c-gvf8-p7v2.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-8c3c-gvf8-p7v2", - "modified": "2024-11-29T06:35:29Z", + "modified": "2024-12-02T09:39:12Z", "published": "2024-11-26T18:38:52Z", "aliases": [ "CVE-2024-52337" @@ -39,6 +39,10 @@ "type": "WEB", "url": "https://security.opensuse.org/2024/11/26/tuned-instance-create.html" }, + { + "type": "WEB", + "url": "https://www.openwall.com/lists/oss-security/2024/11/28/1" + }, { "type": "WEB", "url": "https://www.openwall.com/lists/oss-security/2024/11/28/2" diff --git a/advisories/unreviewed/2024/11/GHSA-9fm7-prpc-h7x8/GHSA-9fm7-prpc-h7x8.json b/advisories/unreviewed/2024/11/GHSA-9fm7-prpc-h7x8/GHSA-9fm7-prpc-h7x8.json index e2ffd48cd98..1b8c7426327 100644 --- a/advisories/unreviewed/2024/11/GHSA-9fm7-prpc-h7x8/GHSA-9fm7-prpc-h7x8.json +++ b/advisories/unreviewed/2024/11/GHSA-9fm7-prpc-h7x8/GHSA-9fm7-prpc-h7x8.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9fm7-prpc-h7x8", - "modified": "2024-11-13T21:30:32Z", + "modified": "2024-12-02T09:39:12Z", "published": "2024-11-09T12:30:48Z", "aliases": [ "CVE-2024-50221" @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -25,6 +23,10 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/4aa923a6e6406b43566ef6ac35a3d9a3197fa3e8" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f111de0f010308949254ee1cc45df8e6b8e1d7d4" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/f8fd9f0d57af4f8f48b383ec28287af85b47cb9f" diff --git a/advisories/unreviewed/2024/11/GHSA-pmfq-rg8w-w57m/GHSA-pmfq-rg8w-w57m.json b/advisories/unreviewed/2024/11/GHSA-pmfq-rg8w-w57m/GHSA-pmfq-rg8w-w57m.json index 02eedab102a..bb76187b3ce 100644 --- a/advisories/unreviewed/2024/11/GHSA-pmfq-rg8w-w57m/GHSA-pmfq-rg8w-w57m.json +++ b/advisories/unreviewed/2024/11/GHSA-pmfq-rg8w-w57m/GHSA-pmfq-rg8w-w57m.json @@ -1,32 +1,34 @@ { "schema_version": "1.4.0", "id": "GHSA-pmfq-rg8w-w57m", - "modified": "2024-11-26T00:33:31Z", + "modified": "2024-12-02T09:39:12Z", "published": "2024-11-26T00:33:31Z", "aliases": [ "CVE-2024-53096" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: resolve faulty mmap_region() error path behaviour\n\nThe mmap_region() function is somewhat terrifying, with spaghetti-like\ncontrol flow and numerous means by which issues can arise and incomplete\nstate, memory leaks and other unpleasantness can occur.\n\nA large amount of the complexity arises from trying to handle errors late\nin the process of mapping a VMA, which forms the basis of recently\nobserved issues with resource leaks and observable inconsistent state.\n\nTaking advantage of previous patches in this series we move a number of\nchecks earlier in the code, simplifying things by moving the core of the\nlogic into a static internal function __mmap_region().\n\nDoing this allows us to perform a number of checks up front before we do\nany real work, and allows us to unwind the writable unmap check\nunconditionally as required and to perform a CONFIG_DEBUG_VM_MAPLE_TREE\nvalidation unconditionally also.\n\nWe move a number of things here:\n\n1. We preallocate memory for the iterator before we call the file-backed\n memory hook, allowing us to exit early and avoid having to perform\n complicated and error-prone close/free logic. We carefully free\n iterator state on both success and error paths.\n\n2. The enclosing mmap_region() function handles the mapping_map_writable()\n logic early. Previously the logic had the mapping_map_writable() at the\n point of mapping a newly allocated file-backed VMA, and a matching\n mapping_unmap_writable() on success and error paths.\n\n We now do this unconditionally if this is a file-backed, shared writable\n mapping. If a driver changes the flags to eliminate VM_MAYWRITE, however\n doing so does not invalidate the seal check we just performed, and we in\n any case always decrement the counter in the wrapper.\n\n We perform a debug assert to ensure a driver does not attempt to do the\n opposite.\n\n3. We also move arch_validate_flags() up into the mmap_region()\n function. This is only relevant on arm64 and sparc64, and the check is\n only meaningful for SPARC with ADI enabled. We explicitly add a warning\n for this arch if a driver invalidates this check, though the code ought\n eventually to be fixed to eliminate the need for this.\n\nWith all of these measures in place, we no longer need to explicitly close\nthe VMA on error paths, as we place all checks which might fail prior to a\ncall to any driver mmap hook.\n\nThis eliminates an entire class of errors, makes the code easier to reason\nabout and more robust.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53096" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/52c81fd0f5a8bf8032687b94ccf00d13b44cc5c8" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/5de195060b2e251a835f622759550e6202167641" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/bdc136e2b05fabcd780fe5f165d154eb779dfcb0" } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": null, "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/11/GHSA-w8mg-g59g-ww6x/GHSA-w8mg-g59g-ww6x.json b/advisories/unreviewed/2024/11/GHSA-w8mg-g59g-ww6x/GHSA-w8mg-g59g-ww6x.json index 1dee3be41d8..d58911d9ba8 100644 --- a/advisories/unreviewed/2024/11/GHSA-w8mg-g59g-ww6x/GHSA-w8mg-g59g-ww6x.json +++ b/advisories/unreviewed/2024/11/GHSA-w8mg-g59g-ww6x/GHSA-w8mg-g59g-ww6x.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-w8mg-g59g-ww6x", - "modified": "2024-11-14T18:30:32Z", + "modified": "2024-12-02T09:39:12Z", "published": "2024-11-09T12:30:49Z", "aliases": [ "CVE-2024-50242" @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -32,12 +30,14 @@ { "type": "WEB", "url": "https://git.kernel.org/stable/c/82685eb6ca1db2bd11190451085bcb86ed03aa24" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d1ac7e2620302e3e49573df39bd4e868e8b4962a" } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/11/GHSA-x9gg-ww2m-r7gj/GHSA-x9gg-ww2m-r7gj.json b/advisories/unreviewed/2024/11/GHSA-x9gg-ww2m-r7gj/GHSA-x9gg-ww2m-r7gj.json index 0eaed5f52b0..560fbe14a9b 100644 --- a/advisories/unreviewed/2024/11/GHSA-x9gg-ww2m-r7gj/GHSA-x9gg-ww2m-r7gj.json +++ b/advisories/unreviewed/2024/11/GHSA-x9gg-ww2m-r7gj/GHSA-x9gg-ww2m-r7gj.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-x9gg-ww2m-r7gj", - "modified": "2024-11-14T18:30:32Z", + "modified": "2024-12-02T09:39:12Z", "published": "2024-11-09T12:30:49Z", "aliases": [ "CVE-2024-50241" @@ -13,18 +13,24 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50241" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/421f1a2a1afb47d88de09457ef7687e1df7bc997" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/63fab04cbd0f96191b6e5beedc3b643b01c15889" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c3074003fa6837c2b89a34d8d12d9463b59d22d6" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/e30a9a2f69c34a00a3cb4fd45c5d231929e66fb1" diff --git a/advisories/unreviewed/2024/12/GHSA-3r56-5r55-j5mh/GHSA-3r56-5r55-j5mh.json b/advisories/unreviewed/2024/12/GHSA-3r56-5r55-j5mh/GHSA-3r56-5r55-j5mh.json new file mode 100644 index 00000000000..91f8deedf18 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-3r56-5r55-j5mh/GHSA-3r56-5r55-j5mh.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3r56-5r55-j5mh", + "modified": "2024-12-02T09:39:12Z", + "published": "2024-12-02T09:39:12Z", + "aliases": [ + "CVE-2024-10490" + ], + "details": "An “Authentication Bypass Using an Alternate Path or Channel” vulnerability in the OPC UA Server configuration required for B&R mapp Cockpit before 6.0, B&R mapp View before 6.0, B&R mapp Services before 6.0, B&R mapp Motion before 6.0 and B&R mapp Vision before 6.0 may be used by an unauthenticated network-based attacker to cause information disclosure, unintended change of data, or denial of service conditions.\nB&R mapp Services is only affected, when mpUserX or mpCodeBox are used in the Automation Studio project.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10490" + }, + { + "type": "WEB", + "url": "https://www.br-automation.com/fileadmin/SA22P014-90c4aa35.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-288" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-02T09:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-fg92-6xpx-v2x4/GHSA-fg92-6xpx-v2x4.json b/advisories/unreviewed/2024/12/GHSA-fg92-6xpx-v2x4/GHSA-fg92-6xpx-v2x4.json new file mode 100644 index 00000000000..0b365a3c460 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-fg92-6xpx-v2x4/GHSA-fg92-6xpx-v2x4.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fg92-6xpx-v2x4", + "modified": "2024-12-02T09:39:12Z", + "published": "2024-12-02T09:39:12Z", + "aliases": [ + "CVE-2024-53104" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format\n\nThis can lead to out of bounds writes since frames of this type were not\ntaken into account when calculating the size of the frames buffer in\nuvc_parse_streaming.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53104" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1ee9d9122801eb688783acd07791f2906b87cb4f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/467d84dc78c9abf6b217ada22b3fdba336262e29" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/575a562f7a3ec2d54ff77ab6810e3fbceef2a91d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/622ad10aae5f5e03b7927ea95f7f32812f692bb5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/684022f81f128338fe3587ec967459669a1204ae" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/95edf13a48e75dc2cc5b0bc57bf90d6948a22fe8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/beced2cb09b58c1243733f374c560a55382003d6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ecf2b43018da9579842c774b7f35dbe11b5c38dd" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/faff5bbb2762c44ec7426037b3000e77a11d6773" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-02T08:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-m934-94j6-4844/GHSA-m934-94j6-4844.json b/advisories/unreviewed/2024/12/GHSA-m934-94j6-4844/GHSA-m934-94j6-4844.json new file mode 100644 index 00000000000..a6249523207 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-m934-94j6-4844/GHSA-m934-94j6-4844.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m934-94j6-4844", + "modified": "2024-12-02T09:39:12Z", + "published": "2024-12-02T09:39:12Z", + "aliases": [ + "CVE-2024-53103" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nhv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer\n\nWhen hvs is released, there is a possibility that vsk->trans may not\nbe initialized to NULL, which could lead to a dangling pointer.\nThis issue is resolved by initializing vsk->trans to NULL.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53103" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/285266ef92f7b4bf7d26e1e95e215ce6a6badb4a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/414476c4fb11be070c09ab8f3e75c9ee324a108a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4bdc5a62c6e50600d8a1c3e18fd6dce0c27c9497" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4fe1d42f2acc463b733bb42e3f8e67dbc2a0eb2d" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7cf25987820350cb950856c71b409e5b6eed52bd" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8621725afb38e111969c64280b71480afde2aace" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/98d8dde9232250a57ad5ef16479bf6a349e09b80" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e0fe3392371293175f25028020ded5267f4cd8e3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e629295bd60abf4da1db85b82819ca6a4f6c1e79" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-02T08:15:08Z" + } +} \ No newline at end of file