Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-11-05 18:33:52 +00:00
parent d866f3ad5e
commit cddb9e2fde
179 changed files with 3465 additions and 396 deletions
@@ -32,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-863"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -52,7 +52,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-476"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-cf5h-fpjr-xpm5",
-  "modified": "2024-02-29T06:30:32Z",
+  "modified": "2024-11-05T18:31:58Z",
  "published": "2024-02-29T06:30:32Z",
  "aliases": [
    "CVE-2023-52479"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix uaf in smb20_oplock_break_ack\n\ndrop reference after use opinfo.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"
+    }
  ],
  "affected": [

@@ -39,7 +42,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-29T06:15:45Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-frwj-xv69-m7pr",
-  "modified": "2024-02-29T00:30:22Z",
+  "modified": "2024-11-05T18:31:58Z",
  "published": "2024-02-29T00:30:21Z",
  "aliases": [
    "CVE-2023-45873"
  ],
  "details": "An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (application exist) because of the OOM killer.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -35,7 +38,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-28T22:15:26Z"
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-276"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-276"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-r5qg-76hh-gr9p",
-  "modified": "2024-02-26T18:30:28Z",
+  "modified": "2024-11-05T18:31:57Z",
  "published": "2024-02-21T06:30:32Z",
  "aliases": [
    "CVE-2024-1676"
  ],
  "details": "Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Low)",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -37,9 +40,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
-    "severity": null,
+    "severity": "CRITICAL",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-21T04:15:08Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-w267-2gcr-ggcp",
-  "modified": "2024-03-04T09:30:28Z",
+  "modified": "2024-11-05T18:31:57Z",
  "published": "2024-02-20T15:31:04Z",
  "aliases": [
    "CVE-2024-1546"
  ],
  "details": "When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memory read. This vulnerability affects Firefox < 123 and Firefox ESR < 115.8.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -45,9 +48,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-125"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-20T14:15:08Z"
@@ -32,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3gf3-x9x8-839v",
-  "modified": "2024-03-27T06:30:32Z",
+  "modified": "2024-11-05T18:31:58Z",
  "published": "2024-03-27T06:30:32Z",
  "aliases": [
    "CVE-2023-46046"
  ],
  "details": "An issue in MiniZinc before 2.8.0 allows a NULL pointer dereference via ti_expr in a crafted .mzn file. NOTE: this is disputed because there is no common libminizinc use case in which an unattended process is supposed to run forever to process a series of atttacker-controlled .mzn files.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -37,9 +40,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-476"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-27T05:15:47Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3q2c-pvp5-3cqp",
-  "modified": "2024-05-01T18:30:35Z",
+  "modified": "2024-11-05T18:31:58Z",
  "published": "2024-03-06T00:31:26Z",
  "aliases": [
    "CVE-2024-24783"
  ],
  "details": "Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
+    }
  ],
  "affected": [

@@ -45,9 +48,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-476"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-05T23:15:07Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-49h9-qx93-p659",
-  "modified": "2024-03-27T09:30:39Z",
+  "modified": "2024-11-05T18:31:58Z",
  "published": "2024-03-27T09:30:39Z",
  "aliases": [
    "CVE-2023-25364"
  ],
  "details": "Opswat Metadefender Core before 5.2.1 does not properly defend against potential HTML injection and XSS attacks.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-27T07:15:47Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7523-56gq-473q",
-  "modified": "2024-03-13T21:31:02Z",
+  "modified": "2024-11-05T18:31:58Z",
  "published": "2024-03-08T03:31:25Z",
  "aliases": [
    "CVE-2024-23255"
  ],
  "details": "An authentication issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4. Photos in the Hidden Photos Album may be viewed without authentication.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
+    }
  ],
  "affected": [

@@ -33,9 +36,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-863"
    ],
-    "severity": null,
+    "severity": "CRITICAL",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-08T02:15:48Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-9wr4-x5hv-2rw2",
-  "modified": "2024-03-15T21:30:43Z",
+  "modified": "2024-11-05T18:31:58Z",
  "published": "2024-03-15T21:30:43Z",
  "aliases": [
    "CVE-2021-47114"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix data corruption by fallocate\n\nWhen fallocate punches holes out of inode size, if original isize is in\nthe middle of last cluster, then the part from isize to the end of the\ncluster will be zeroed with buffer write, at that time isize is not yet\nupdated to match the new size, if writeback is kicked in, it will invoke\nocfs2_writepage()->block_write_full_page() where the pages out of inode\nsize will be dropped.  That will cause file corruption.  Fix this by\nzero out eof blocks when extending the inode size.\n\nRunning the following command with qemu-image 4.2.1 can get a corrupted\ncoverted image file easily.\n\n    qemu-img convert -p -t none -T none -f qcow2 $qcow_image \\\n             -O qcow2 -o compat=1.1 $qcow_image.conv\n\nThe usage of fallocate in qemu is like this, it first punches holes out\nof inode size, then extend the inode size.\n\n    fallocate(11, FALLOC_FL_KEEP_SIZE|FALLOC_FL_PUNCH_HOLE, 2276196352, 65536) = 0\n    fallocate(11, 0, 2276196352, 65536) = 0\n\nv1: https://www.spinics.net/lists/linux-fsdevel/msg193999.html\nv2: https://lore.kernel.org/linux-fsdevel/20210525093034.GB4112@quack2.suse.cz/T/",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -55,7 +58,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-15T21:15:06Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-c534-6v46-r777",
-  "modified": "2024-03-14T00:31:05Z",
+  "modified": "2024-11-05T18:31:58Z",
  "published": "2024-03-08T03:31:25Z",
  "aliases": [
    "CVE-2024-23291"
  ],
  "details": "A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. A malicious app may be able to observe user data in log entries related to accessibility notifications.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
  ],
  "affected": [

@@ -51,7 +54,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-08T02:15:50Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-g754-37wh-7wv7",
-  "modified": "2024-03-03T00:30:30Z",
+  "modified": "2024-11-05T18:31:58Z",
  "published": "2024-03-03T00:30:30Z",
  "aliases": [
    "CVE-2023-52502"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()\n\nSili Luo reported a race in nfc_llcp_sock_get(), leading to UAF.\n\nGetting a reference on the socket found in a lookup while\nholding a lock should happen before releasing the lock.\n\nnfc_llcp_sock_get_sn() has a similar problem.\n\nFinally nfc_llcp_recv_snl() needs to make sure the socket\nfound by nfc_llcp_sock_from_sn() does not disappear.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H"
+    }
  ],
  "affected": [

@@ -51,7 +54,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-02T22:15:47Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-mf3p-gmch-hc8x",
-  "modified": "2024-03-26T15:30:48Z",
+  "modified": "2024-11-05T18:31:58Z",
  "published": "2024-03-26T12:31:27Z",
  "aliases": [
    "CVE-2024-28034"
  ],
  "details": "Cross-site scripting vulnerability exists in Mini Thread Version 3.33βi. An arbitrary script may be executed on the web browser of the user accessing the website that uses the product. Note that the developer was unreachable, therefore, users should consider stop using Mini Thread Version 3.33βi.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-26T10:15:09Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-vpgg-8ccq-gwhg",
-  "modified": "2024-03-25T09:32:36Z",
+  "modified": "2024-11-05T18:31:58Z",
  "published": "2024-03-25T09:32:35Z",
  "aliases": [
    "CVE-2021-47153"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: i801: Don't generate an interrupt on bus reset\n\nNow that the i2c-i801 driver supports interrupts, setting the KILL bit\nin a attempt to recover from a timed out transaction triggers an\ninterrupt. Unfortunately, the interrupt handler (i801_isr) is not\nprepared for this situation and will try to process the interrupt as\nif it was signaling the end of a successful transaction. In the case\nof a block transaction, this can result in an out-of-range memory\naccess.\n\nThis condition was reproduced several times by syzbot:\nhttps://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e\nhttps://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e\nhttps://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e\nhttps://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb\nhttps://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a\nhttps://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79\n\nSo disable interrupts while trying to reset the bus. Interrupts will\nbe enabled again for the following transaction.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H"
+    }
  ],
  "affected": [

@@ -55,7 +58,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-25T09:15:09Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-x7cq-pgcc-cqqm",
-  "modified": "2024-03-25T09:32:35Z",
+  "modified": "2024-11-05T18:31:58Z",
  "published": "2024-03-25T09:32:35Z",
  "aliases": [
    "CVE-2021-47137"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lantiq: fix memory corruption in RX ring\n\nIn a situation where memory allocation or dma mapping fails, an\ninvalid address is programmed into the descriptor. This can lead\nto memory corruption. If the memory allocation fails, DMA should\nreuse the previous skb and mapping and drop the packet. This patch\nalso increments rx drop counter.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -37,9 +40,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-770"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-25T09:15:08Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-xqc9-rv8w-5v6g",
-  "modified": "2024-03-11T21:31:25Z",
+  "modified": "2024-11-05T18:31:58Z",
  "published": "2024-03-11T21:31:25Z",
  "aliases": [
    "CVE-2024-22010"
  ],
  "details": "In dvfs_plugin_caller of fvp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-125"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-11T19:15:47Z"
--- a/Show More
+++ b/Show More