Debian Linux vulnerabilities

CVE-2023-6040 [HIGH] CWE-125 CVE-2023-6040: An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (n An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an attacker to achieve out-of-bounds access.

CVE-2020-14351 [HIGH] CWE-416 CVE-2020-14351: A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem a A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVE-2023-52159 [HIGH] CWE-787 CVE-2023-52159: A stack-based buffer overflow vulnerability in gross 0.9.3 through 1.x before 1.0.4 allows remote at A stack-based buffer overflow vulnerability in gross 0.9.3 through 1.x before 1.0.4 allows remote attackers to trigger a denial of service (grossd daemon crash) or potentially execute arbitrary code in grossd via crafted SMTP transaction parameters that cause an incorrect strncat for a log entry.

CVE-2024-40635 [HIGH] CWE-190 CVE-2024-40635: containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6. containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for en

CVE-2025-37752 [HIGH] CWE-129 CVE-2025-37752: In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: move the li In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: move the limit validation It is not sufficient to directly validate the limit on the data that the user passes as it can be updated based on how the other parameters are changed. Move the check at the end of the configuration update process to also catch scenario

CVE-2024-41000 [HIGH] CWE-190 CVE-2024-41000: In the Linux kernel, the following vulnerability has been resolved: block/ioctl: prefer different o In the Linux kernel, the following vulnerability has been resolved: block/ioctl: prefer different overflow check Running syzkaller with the newly reintroduced signed integer overflow sanitizer shows this report: [ 62.982337] ------------[ cut here ]------------ [ 62.985692] cgroup: Invalid name [ 62.986211] UBSAN: signed-integer-overflow in ../block

CVE-2025-37927 [HIGH] CWE-787 CVE-2025-37927: In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix potential buffer In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid There is a string parsing logic error which can lead to an overflow of hid or uid buffers. Comparing ACPIID_LEN against a total string length doesn't take into account the lengths of individual hid and uid buffers so the

CVE-2023-4015 [HIGH] CWE-416 CVE-2023-4015: A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used. We recommend upgrading past commi

CVE-2023-4623 [HIGH] CWE-416 CVE-2023-4623: A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remov

CVE-2019-11008 [HIGH] CWE-787 CVE-2019-11008: In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer overflow in the function Wr In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer overflow in the function WriteXWDImage of coders/xwd.c, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file.

CVE-2018-12362 [HIGH] CWE-190 CVE-2018-12362: An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Ext An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

CVE-2018-14681 [HIGH] CWE-787 CVE-2018-14681: An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KW An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite.

CVE-2024-26956 [HIGH] CVE-2024-26956: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix failure to detect D In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix failure to detect DAT corruption in btree and direct mappings Patch series "nilfs2: fix kernel bug at submit_bh_wbc()". This resolves a kernel BUG reported by syzbot. Since there are two flaws involved, I've made each one a separate patch. The first patch alone resolves the syz

CVE-2025-37810 [HIGH] CWE-787 CVE-2025-37810: In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: check that e In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: check that event count does not exceed event buffer length The event count is read from register DWC3_GEVNTCOUNT. There is a check for the count being zero, but not for exceeding the event buffer length. Check that event count does not exceed event buffer length, a

CVE-2009-5043 [CRITICAL] CWE-755 CVE-2009-5043: burn allows file names to escape via mishandled quotation marks burn allows file names to escape via mishandled quotation marks

CVE-2024-46852 [HIGH] CWE-193 CVE-2024-46852: In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix off-by-one In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix off-by-one in CMA heap fault handler Until VM_DONTEXPAND was added in commit 1c1914d6e8c6 ("dma-buf: heaps: Don't track CMA dma-buf pages under RssFile") it was possible to obtain a mapping larger than the buffer size via mremap and bypass the overflow check in dma

CVE-2025-38068 [HIGH] CWE-787 CVE-2025-38068: In the Linux kernel, the following vulnerability has been resolved: crypto: lzo - Fix compression b In the Linux kernel, the following vulnerability has been resolved: crypto: lzo - Fix compression buffer overrun Unlike the decompression code, the compression code in LZO never checked for output overruns. It instead assumes that the caller always provides enough buffer space, disregarding the buffer length provided by the caller. Add a safe compre

CVE-2025-38348 [HIGH] CWE-787 CVE-2025-38348: In the Linux kernel, the following vulnerability has been resolved: wifi: p54: prevent buffer-overf In the Linux kernel, the following vulnerability has been resolved: wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() Robert Morris reported: |If a malicious USB device pretends to be an Intersil p54 wifi |interface and generates an eeprom_readback message with a large |eeprom->v1.len, p54_rx_eeprom_readback() will copy data from the |m

CVE-2025-38702 [HIGH] CWE-787 CVE-2025-38702: In the Linux kernel, the following vulnerability has been resolved: fbdev: fix potential buffer ove In the Linux kernel, the following vulnerability has been resolved: fbdev: fix potential buffer overflow in do_register_framebuffer() The current implementation may lead to buffer overflow when: 1. Unregistration creates NULL gaps in registered_fb[] 2. All array slots become occupied despite num_registered_fb < FB_MAX 3. The registration loop exceeds

CVE-2023-39945 [HIGH] CWE-248 CVE-2023-39945: eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Ma eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.0, 2.10.2, 2.9.2, and 2.6.5, a data submessage sent to PDP port raises unhandled `BadParamException` in fastcdr, which in turn crashes fastdds. Versions 2.11.0, 2.10.2, 2.9.2, and 2.6.5 contain a patch for this iss