Debian Linux vulnerabilities

CVE-2024-35811 [MEDIUM] CVE-2024-35811: In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix use-after-f In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach This is the candidate patch of CVE-2023-47233 : https://nvd.nist.gov/vuln/detail/CVE-2023-47233 In brcm80211 driver,it starts with the following invoking chain to start init a timeout worker: ->brcmf_usb_probe ->brcmf_usb_pr

CVE-2025-38293 [MEDIUM] CVE-2025-38293: In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix node corrupti In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix node corruption in ar->arvifs list In current WLAN recovery code flow, ath11k_core_halt() only reinitializes the "arvifs" list head. This will cause the list node immediately following the list head to become an invalid list node. Because the prev of that node still point

CVE-2022-38861 [MEDIUM] CWE-787 CVE-2022-38861: The MPlayer Project mplayer SVN-r38374-13.0.1 is vulnerable to memory corruption via function free_m The MPlayer Project mplayer SVN-r38374-13.0.1 is vulnerable to memory corruption via function free_mp_image() of libmpcodecs/mp_image.c.

CVE-2022-1516 [MEDIUM] CWE-416 CVE-2022-1516: A NULL pointer dereference flaw was found in the Linux kernel’s X.25 set of standardized network pro A NULL pointer dereference flaw was found in the Linux kernel’s X.25 set of standardized network protocols functionality in the way a user terminates their session using a simulated Ethernet card and continued usage of this connection. This flaw allows a local user to crash the system.

CVE-2022-23034 [MEDIUM] CWE-191 CVE-2022-23034: A PV guest could DoS Xen while unmapping a grant To address XSA-380, reference counting was introduc A PV guest could DoS Xen while unmapping a grant To address XSA-380, reference counting was introduced for grant mappings for the case where a PV guest would have the IOMMU enabled. PV guests can request two forms of mappings. When both are in use for any individual mapping, unmapping of such a mapping can be requested in two steps. The reference co

CVE-2015-4752 [MEDIUM] CVE-2015-4752: Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows re Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to Server : I_S.

CVE-2025-39894 [MEDIUM] CVE-2025-39894: In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: do not In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm When send a broadcast packet to a tap device, which was added to a bridge, br_nf_local_in() is called to confirm the conntrack. If another conntrack with the same hash value is added to the hash table, wh

CVE-2024-35915 [MEDIUM] CWE-908 CVE-2024-35915: In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value in n In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet syzbot reported the following uninit-value access issue [1][2]: nci_rx_work() parses and processes received packet. When the payload length is zero, each message type handler reads uninitialized payload and KMSAN detects

CVE-2022-2869 [MEDIUM] CWE-191 CVE-2022-2869: libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw could cause a crash or potentially further ex

CVE-2025-39857 [MEDIUM] CWE-476 CVE-2025-39857: In the Linux kernel, the following vulnerability has been resolved: net/smc: fix one NULL pointer d In the Linux kernel, the following vulnerability has been resolved: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() BUG: kernel NULL pointer dereference, address: 00000000000002ec PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 28 UID: 0 PID: 343 Comm: kworker/28:1 Kdump: loaded Tainted: G OE 6.17.0-rc2+ #9 NONE Tainted: [O]=OO

CVE-2025-37862 [MEDIUM] CWE-476 CVE-2025-37862: In the Linux kernel, the following vulnerability has been resolved: HID: pidff: Fix null pointer de In the Linux kernel, the following vulnerability has been resolved: HID: pidff: Fix null pointer dereference in pidff_find_fields This function triggered a null pointer dereference if used to search for a report that isn't implemented on the device. This happened both for optional and required reports alike. The same logic was applied to pidff_fin

CVE-2016-7440 [MEDIUM] CVE-2016-7440: The C software implementation of AES Encryption and Decryption in wolfSSL (formerly CyaSSL) before 3 The C software implementation of AES Encryption and Decryption in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover AES keys by leveraging cache-bank timing differences.

CVE-2025-37867 [MEDIUM] CVE-2025-37867: In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Silence oversized kv In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Silence oversized kvmalloc() warning syzkaller triggered an oversized kvmalloc() warning. Silence it by adding __GFP_NOWARN. syzkaller log: WARNING: CPU: 7 PID: 518 at mm/util.c:665 __kvmalloc_node_noprof+0x175/0x180 CPU: 7 UID: 0 PID: 518 Comm: c_repro Not tainted 6.11.0-rc6+

CVE-2012-2751 [MEDIUM] CVE-2012-2751: ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the begi ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks. NOTE:

CVE-2025-37756 [MEDIUM] CVE-2025-37756: In the Linux kernel, the following vulnerability has been resolved: net: tls: explicitly disallow d In the Linux kernel, the following vulnerability has been resolved: net: tls: explicitly disallow disconnect syzbot discovered that it can disconnect a TLS socket and then run into all sort of unexpected corner cases. I have a vague recollection of Eric pointing this out to us a long time ago. Supporting disconnect is really hard, for one thing if offload

CVE-2025-38003 [MEDIUM] CVE-2025-38003: In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu read In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu read protection for procfs content When the procfs content is generated for a bcm_op which is in the process to be removed the procfs output might show unreliable data (UAF). As the removal of bcm_op's is already implemented with rcu handling this patch adds the m

CVE-2022-42324 [MEDIUM] CWE-681 CVE-2022-42324: Oxenstored 32->31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precis Oxenstored 32->31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C uint32_t out of the ring and casts it directly to an Ocaml integer. In 64-bit Ocaml builds this is fine, but in 32-bit builds, it truncates off the most significant bit, and then creates unsigned/signed confusio

CVE-2021-3669 [MEDIUM] CWE-400 CVE-2021-3669: A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS.

CVE-2024-26889 [MEDIUM] CWE-120 CVE-2024-26889: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix possib In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix possible buffer overflow struct hci_dev_info has a fixed size name[8] field so in the event that hdev->name is bigger than that strcpy would attempt to write past its size, so this fixes this problem by switching to use strscpy.

CVE-2023-52623 [MEDIUM] CWE-22 CVE-2023-52623: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix a suspicious RCU us In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix a suspicious RCU usage warning I received the following warning while running cthon against an ontap server running pNFS: [ 57.202521] ============================= [ 57.202522] WARNING: suspicious RCU usage [ 57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted [ 57.2