Debian Linux vulnerabilities

CVE-2022-2868 [MEDIUM] CWE-20 CVE-2022-2868: libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop.

CVE-2020-27830 [MEDIUM] CWE-476 CVE-2020-27830: A vulnerability was found in Linux Kernel where in the spk_ttyio_receive_buf2() function, it would d A vulnerability was found in Linux Kernel where in the spk_ttyio_receive_buf2() function, it would dereference spk_ttyio_synth without checking whether it is NULL or not, and may lead to a NULL-ptr deref crash.

CVE-2012-2751 [MEDIUM] CVE-2012-2751: ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the begi ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks. NOTE:

CVE-2024-26809 [MEDIUM] CVE-2024-26809: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: rele In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: release elements in clone only from destroy path Clone already always provides a current view of the lookup table, use it to destroy the set, otherwise it is possible to destroy elements twice. This fix requires: 212ed75dc5fb ("netfilter: nf_tables: integrate p

CVE-2024-27038 [MEDIUM] CWE-476 CVE-2024-27038: In the Linux kernel, the following vulnerability has been resolved: clk: Fix clk_core_get NULL dere In the Linux kernel, the following vulnerability has been resolved: clk: Fix clk_core_get NULL dereference It is possible for clk_core_get to dereference a NULL in the following sequence: clk_core_get() of_clk_get_hw_from_clkspec() __of_clk_get_hw_from_provider() __clk_get_hw() __clk_get_hw() can return NULL which is dereferenced by clk_core_get(

CVE-2024-26994 [MEDIUM] CVE-2024-26994: In the Linux kernel, the following vulnerability has been resolved: speakup: Avoid crash on very lo In the Linux kernel, the following vulnerability has been resolved: speakup: Avoid crash on very long word In case a console is set up really large and contains a really long word (> 256 characters), we have to stop before the length of the word buffer.

CVE-2024-27025 [MEDIUM] CWE-476 CVE-2024-27025: In the Linux kernel, the following vulnerability has been resolved: nbd: null check for nla_nest_st In the Linux kernel, the following vulnerability has been resolved: nbd: null check for nla_nest_start nla_nest_start() may fail and return NULL. Insert a check and set errno based on other call sites within the same source code.

CVE-2024-27074 [MEDIUM] CWE-401 CVE-2024-27074: In the Linux kernel, the following vulnerability has been resolved: media: go7007: fix a memleak in In the Linux kernel, the following vulnerability has been resolved: media: go7007: fix a memleak in go7007_load_encoder In go7007_load_encoder, bounce(i.e. go->boot_fw), is allocated without a deallocation thereafter. After the following call chain: saa7134_go7007_init |-> go7007_boot_encoder |-> go7007_load_encoder |-> kfree(go) go is freed and

CVE-2023-52670 [MEDIUM] CWE-401 CVE-2023-52670: In the Linux kernel, the following vulnerability has been resolved: rpmsg: virtio: Free driver_over In the Linux kernel, the following vulnerability has been resolved: rpmsg: virtio: Free driver_override when rpmsg_remove() Free driver_override when rpmsg_remove(), otherwise the following memory leak will occur: unreferenced object 0xffff0000d55d7080 (size 128): comm "kworker/u8:2", pid 56, jiffies 4294893188 (age 214.272s) hex dump (first 32 by

CVE-2022-38866 [MEDIUM] CWE-787 CVE-2022-38866: Certain The MPlayer Project products are vulnerable to Buffer Overflow via read_avi_header() of libm Certain The MPlayer Project products are vulnerable to Buffer Overflow via read_avi_header() of libmpdemux/aviheader.c . This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.

CVE-2024-27044 [MEDIUM] CWE-476 CVE-2024-27044: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()' The 'stream' pointer is used in dcn10_set_output_transfer_func() before the check if 'stream' is NULL. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn10/dcn10_hwseq.c:1

CVE-2022-3061 [MEDIUM] CWE-369 CVE-2022-3061: Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the drive Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by zero error.

CVE-2022-34680 [MEDIUM] CWE-197 CVE-2022-34680: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an integer truncation can lead to an out-of-bounds read, which may lead to denial of service.

CVE-2023-52882 [MEDIUM] CVE-2023-52882: In the Linux kernel, the following vulnerability has been resolved: clk: sunxi-ng: h6: Reparent CPU In the Linux kernel, the following vulnerability has been resolved: clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change While PLL CPUX clock rate change when CPU is running from it works in vast majority of cases, now and then it causes instability. This leads to system crashes and other undefined behaviour. After a lot of testing (30+ hours) whil

CVE-2024-56705 [MEDIUM] CWE-617 CVE-2024-56705: In the Linux kernel, the following vulnerability has been resolved: media: atomisp: Add check for r In the Linux kernel, the following vulnerability has been resolved: media: atomisp: Add check for rgby_data memory allocation failure In ia_css_3a_statistics_allocate(), there is no check on the allocation result of the rgby_data memory. If rgby_data is not successfully allocated, it may trigger the assert(host_stats->rgby_data) assertion in ia_css

CVE-2024-26925 [MEDIUM] CWE-667 CVE-2024-26925: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release m In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path The commit mutex should not be released during the critical section between nft_gc_seq_begin() and nft_gc_seq_end(), otherwise, async GC worker could collect expired objects and get the released commit lock wi

CVE-2024-36946 [MEDIUM] CWE-401 CVE-2024-36946: In the Linux kernel, the following vulnerability has been resolved: phonet: fix rtm_phonet_notify() In the Linux kernel, the following vulnerability has been resolved: phonet: fix rtm_phonet_notify() skb allocation fill_route() stores three components in the skb: - struct rtmsg - RTA_DST (u8) - RTA_OIF (u32) Therefore, rtm_phonet_notify() should use NLMSG_ALIGN(sizeof(struct rtmsg)) + nla_total_size(1) + nla_total_size(4)

CVE-2024-26642 [MEDIUM] CVE-2024-26642: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow anonymous set with timeout flag Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work.

CVE-2024-35950 [MEDIUM] CVE-2024-35950: In the Linux kernel, the following vulnerability has been resolved: drm/client: Fully protect modes In the Linux kernel, the following vulnerability has been resolved: drm/client: Fully protect modes[] with dev->mode_config.mutex The modes[] array contains pointers to modes on the connectors' mode lists, which are protected by dev->mode_config.mutex. Thus we need to extend modes[] the same protection or by the time we use it the elements may already be p

CVE-2023-52672 [MEDIUM] CWE-400 CVE-2023-52672: In the Linux kernel, the following vulnerability has been resolved: pipe: wakeup wr_wait after sett In the Linux kernel, the following vulnerability has been resolved: pipe: wakeup wr_wait after setting max_usage Commit c73be61cede5 ("pipe: Add general notification queue support") a regression was introduced that would lock up resized pipes under certain conditions. See the reproducer in [1]. The commit resizing the pipe ring size was moved to a