Debian Linux vulnerabilities

CVE-2022-28390 [HIGH] CWE-415 CVE-2022-28390: ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.

CVE-2017-17845 [HIGH] CWE-338 CVE-2017-17845: An issue was discovered in Enigmail before 1.9.9. Improper Random Secret Generation occurs because M An issue was discovered in Enigmail before 1.9.9. Improper Random Secret Generation occurs because Math.Random() is used by pretty Easy privacy (pEp), aka TBE-01-001.

CVE-2017-9780 [HIGH] CWE-732 CVE-2017-9780: In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain file In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for example setuid or world-writable. The files are deployed with those permissions, which would let a local attacker run the setuid executable or write to the world-writable location. In the case of the "system helper" c

CVE-2020-36478 [HIGH] CWE-295 CVE-2020-36478: An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). A N An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). A NULL algorithm parameters entry looks identical to an array of REAL (size zero) and thus the certificate is considered valid. However, if the parameters do not match in any way, then the certificate should be considered invalid.

CVE-2018-20152 [MEDIUM] CWE-20 CVE-2018-20152: In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post t In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input.

CVE-2024-27024 [HIGH] CVE-2024-27024: In the Linux kernel, the following vulnerability has been resolved: net/rds: fix WARNING in rds_con In the Linux kernel, the following vulnerability has been resolved: net/rds: fix WARNING in rds_conn_connect_if_down If connection isn't established yet, get_mr() will fail, trigger connection after get_mr().

CVE-2017-12136 [HIGH] CWE-362 CVE-2017-12136: Race condition in the grant table code in Xen 4.6.x through 4.9.x allows local guest OS administrato Race condition in the grant table code in Xen 4.6.x through 4.9.x allows local guest OS administrators to cause a denial of service (free list corruption and host crash) or gain privileges on the host via vectors involving maptrack free list handling.

CVE-2024-27073 [HIGH] CWE-401 CVE-2024-27073: In the Linux kernel, the following vulnerability has been resolved: media: ttpci: fix two memleaks In the Linux kernel, the following vulnerability has been resolved: media: ttpci: fix two memleaks in budget_av_attach When saa7146_register_device and saa7146_vv_init fails, budget_av_attach should free the resources it allocates, like the error-handling of ttpci_budget_init does. Besides, there are two fixme comment refers to such deallocations.

CVE-2024-26928 [HIGH] CWE-416 CVE-2024-26928: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_debug_files_proc_show() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.

CVE-2024-49966 [HIGH] CWE-416 CVE-2024-49966: In the Linux kernel, the following vulnerability has been resolved: ocfs2: cancel dqi_sync_work bef In the Linux kernel, the following vulnerability has been resolved: ocfs2: cancel dqi_sync_work before freeing oinfo ocfs2_global_read_info() will initialize and schedule dqi_sync_work at the end, if error occurs after successfully reading global quota, it will trigger the following warning with CONFIG_DEBUG_OBJECTS_* enabled: ODEBUG: free active (a

CVE-2024-26704 [HIGH] CWE-415 CVE-2024-26704: In the Linux kernel, the following vulnerability has been resolved: ext4: fix double-free of blocks In the Linux kernel, the following vulnerability has been resolved: ext4: fix double-free of blocks due to wrong extents moved_len In ext4_move_extents(), moved_len is only updated when all moves are successfully executed, and only discards orig_inode and donor_inode preallocations when moved_len is not zero. When the loop fails to exit after success

CVE-2024-35867 [HIGH] CWE-416 CVE-2024-35867: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_stats_proc_show() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.

CVE-2024-26772 [HIGH] CVE-2024-26772: In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks f In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avoid allocating blocks from the group with a corrupted block bitmap.

CVE-2019-17341 [HIGH] CWE-362 CVE-2019-17341: An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of se An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a page-writability race condition during addition of a passed-through PCI device.

CVE-2024-46821 [HIGH] CWE-129 CVE-2024-46821: In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Fix negative array In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Fix negative array index read Avoid using the negative values for clk_idex as an index into an array pptable->DpmDescriptor. V2: fix clk_index return check (Tim Huang)

CVE-2024-46812 [HIGH] CVE-2024-46812: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip inactive In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration [Why] Coverity reports Memory - illegal accesses. [How] Skip inactive planes.

CVE-2024-44977 [HIGH] CWE-787 CVE-2024-44977: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Validate TA binary In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Validate TA binary size Add TA binary size validation to avoid OOB write. (cherry picked from commit c0a04e3570d72aaf090962156ad085e37c62e442)

CVE-2025-38416 [HIGH] CVE-2025-38416: In the Linux kernel, the following vulnerability has been resolved: NFC: nci: uart: Set tty->disc_d In the Linux kernel, the following vulnerability has been resolved: NFC: nci: uart: Set tty->disc_data only in success path Setting tty->disc_data before opening the NCI device means we need to clean it up on error paths. This also opens some short window if device starts sending data, even before NCIUARTSETDRIVER IOCTL succeeded (broken hardware?). Close th

CVE-2024-49986 [HIGH] CWE-416 CVE-2024-49986: In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-table In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: Fix use after free on platform_device_register() errors x86_android_tablet_remove() frees the pdevs[] array, so it should not be used after calling x86_android_tablet_remove(). When platform_device_register() fails, store the pdevs[x] PTR_ERR() val

CVE-2023-52679 [HIGH] CWE-415 CVE-2023-52679: In the Linux kernel, the following vulnerability has been resolved: of: Fix double free in of_parse In the Linux kernel, the following vulnerability has been resolved: of: Fix double free in of_parse_phandle_with_args_map In of_parse_phandle_with_args_map() the inner loop that iterates through the map entries calls of_node_put(new) to free the reference acquired by the previous iteration of the inner loop. This assumes that the value of "new" is NU