Debian Linux vulnerabilities

CVE-2024-35886 [HIGH] CWE-674 CVE-2024-35886: In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix infinite recursion in In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix infinite recursion in fib6_dump_done(). syzkaller reported infinite recursive calls of fib6_dump_done() during netlink socket destruction. [1] From the log, syzkaller sent an AF_UNSPEC RTM_GETROUTE message, and then the response was generated. The following recvmmsg() resu

CVE-2024-47697 [HIGH] CWE-787 CVE-2024-47697: In the Linux kernel, the following vulnerability has been resolved: drivers: media: dvb-frontends/r In the Linux kernel, the following vulnerability has been resolved: drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error Ensure index in rtl2830_pid_filter does not exceed 31 to prevent out-of-bounds access. dev->filters is a 32-bit value, so set_bit and clear_bit functions should only operate on indices from 0 to 31. If index is

CVE-2023-52612 [HIGH] CWE-120 CVE-2023-52612: In the Linux kernel, the following vulnerability has been resolved: crypto: scomp - fix req->dst bu In the Linux kernel, the following vulnerability has been resolved: crypto: scomp - fix req->dst buffer overflow The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid req->dst buffer overflow problem.

CVE-2024-26852 [HIGH] CWE-416 CVE-2024-26852: In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() syzbot found another use-after-free in ip6_route_mpath_notify() [1] Commit f7225172f25a ("net/ipv6: prevent use after free in ip6_route_mpath_notify") was not able to fix the root cause. We need to defer the fib6_info_release

CVE-2024-47698 [HIGH] CWE-787 CVE-2024-47698: In the Linux kernel, the following vulnerability has been resolved: drivers: media: dvb-frontends/r In the Linux kernel, the following vulnerability has been resolved: drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error Ensure index in rtl2832_pid_filter does not exceed 31 to prevent out-of-bounds access. dev->filters is a 32-bit value, so set_bit and clear_bit functions should only operate on indices from 0 to 31. If index is

CVE-2025-37854 [HIGH] CWE-416 CVE-2025-37854: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix mode1 reset cra In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix mode1 reset crash issue If HW scheduler hangs and mode1 reset is used to recover GPU, KFD signal user space to abort the processes. After process abort exit, user queues still use the GPU to access system memory before h/w is reset while KFD cleanup worker free system

CVE-2022-2978 [HIGH] CWE-416 CVE-2022-2978: A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers funct A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.

CVE-2020-11061 [HIGH] CWE-122 CVE-2020-11061: In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in Bareos versions 19.2.8, 18.2.9 and 17.2.10.

CVE-2024-26895 [HIGH] CWE-416 CVE-2024-26895: In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: prevent use-aft In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces wilc_netdev_cleanup currently triggers a KASAN warning, which can be observed on interface registration error path, or simply by removing the module/unbinding device from driver: echo spi0.1 > /sys/bus/spi

CVE-2025-38512 [HIGH] CVE-2025-38512: In the Linux kernel, the following vulnerability has been resolved: wifi: prevent A-MSDU attacks in In the Linux kernel, the following vulnerability has been resolved: wifi: prevent A-MSDU attacks in mesh networks This patch is a mitigation to prevent the A-MSDU spoofing vulnerability for mesh networks. The initial update to the IEEE 802.11 standard, in response to the FragAttacks, missed this case (CVE-2025-27558). It can be considered a variant of CVE-20

CVE-2024-50063 [HIGH] CVE-2024-50063: In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent tail call between In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent tail call between progs attached to different hooks bpf progs can be attached to kernel functions, and the attached functions can take different parameters or return different return values. If prog attached to one kernel function tail calls prog attached to another kernel functi

CVE-2025-39860 [HIGH] CWE-416 CVE-2025-39860: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free i In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the

CVE-2025-38077 [HIGH] CWE-787 CVE-2025-38077: In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() If the 'buf' array received from the user contains an empty string, the 'length' variable will be zero. Accessing the 'buf' array element with index 'length - 1' will result in a buffer overflow. Add a c

CVE-2024-35905 [HIGH] CWE-129 CVE-2024-35905: In the Linux kernel, the following vulnerability has been resolved: bpf: Protect against int overfl In the Linux kernel, the following vulnerability has been resolved: bpf: Protect against int overflow for stack access size This patch re-introduces protection against the size of access to stack memory being negative; the access size can appear negative as a result of overflowing its signed int representation. This should not actually happen, as the

CVE-2015-5212 [MEDIUM] CWE-191 CVE-2015-5212: Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configura Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configuration setting "Load printer settings with the document" is enabled, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via crafted PrinterSetup data in an ODF document.

CVE-2025-37979 [HIGH] CWE-787 CVE-2025-37979: In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: Fix sc7280 lpass po In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: Fix sc7280 lpass potential buffer overflow Case values introduced in commit 5f78e1fb7a3e ("ASoC: qcom: Add driver support for audioreach solution") cause out of bounds access in arrays of sc7280 driver data (e.g. in case of RX_CODEC_DMA_RX_0 in sc7280_snd_hw_params()). R

CVE-2006-2016 [LOW] CWE-79 CVE-2006-2016: Multiple cross-site scripting (XSS) vulnerabilities in phpLDAPadmin 0.9.8 and earlier allow remote a Multiple cross-site scripting (XSS) vulnerabilities in phpLDAPadmin 0.9.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dn parameter in (a) compare_form.php, (b) copy_form.php, (c) rename_form.php, (d) template_engine.php, and (e) delete_form.php; (2) scope parameter in (f) search.php; and (3) Container DN, (4) Mach

CVE-2025-38428 [HIGH] CWE-787 CVE-2025-38428: In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - check record s In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - check record size in ims_pcu_flash_firmware() The "len" variable comes from the firmware and we generally do trust firmware, but it's always better to double check. If the "len" is too large it could result in memory corruption when we do "memcpy(fragment->data, rec-

CVE-2025-38459 [HIGH] CWE-674 CVE-2025-38459: In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix infinite recursi In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix infinite recursive call of clip_push(). syzbot reported the splat below. [0] This happens if we call ioctl(ATMARP_MKIP) more than once. During the first call, clip_mkip() sets clip_push() to vcc->push(), and the second call copies it to clip_vcc->old_push(). Later,

CVE-2022-2255 [HIGH] CWE-348 CVE-2022-2255: A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing.