Debian Linux vulnerabilities

CVE-2022-49919 [HIGH] CVE-2022-49919: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flow rule object from commit path No need to postpone this to the commit release path, since no packets are walking over this object, this is accessed from control plane only. This helped uncovered UAF triggered by races with the netlink notifier. Scope: local bookworm: r

CVE-2021-33656 [MEDIUM] CVE-2021-33656: linux - When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write mem... When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds. Scope: local bookworm: resolved (fixed in 5.14.6-1) bullseye: resolved (fixed in 5.10.127-1) forky: resolved (fixed in 5.14.6-1) sid: resolved (fixed in 5.14.6-1) trixie: resolved (fixed in 5.14.6-1)

CVE-2019-19532 [MEDIUM] CVE-2019-19532: linux - In the Linux kernel before 5.3.9, there are multiple out-of-bounds write bugs th... In the Linux kernel before 5.3.9, there are multiple out-of-bounds write bugs that can be caused by a malicious USB device in the Linux kernel HID drivers, aka CID-d9d4b1e46d95. This affects drivers/hid/hid-axff.c, drivers/hid/hid-dr.c, drivers/hid/hid-emsff.c, drivers/hid/hid-gaff.c, drivers/hid/hid-holtekff.c, drivers/hid/hid-lg2ff.c, drivers/hid/hid-lg3ff.c, driv

CVE-2019-19527 [MEDIUM] CVE-2019-19527: linux - In the Linux kernel before 5.2.10, there is a use-after-free bug that can be cau... In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/hid/usbhid/hiddev.c driver, aka CID-9c09b214f30e. Scope: local bookworm: resolved (fixed in 5.2.17-1) bullseye: resolved (fixed in 5.2.17-1) forky: resolved (fixed in 5.2.17-1) sid: resolved (fixed in 5.2.17-1) trixie: resolved (fixed in 5.2.1

CVE-2020-12770 [MEDIUM] CVE-2020-12770: linux - An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg... An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a certain failure case, aka CID-83c6f2390040. Scope: local bookworm: resolved (fixed in 5.6.14-1) bullseye: resolved (fixed in 5.6.14-1) forky: resolved (fixed in 5.6.14-1) sid: resolved (fixed in 5.6.14-1) trixie: resolved (fixed in 5.6.14-1)

CVE-2020-0465 [MEDIUM] CVE-2020-0465: linux - In various methods of hid-multitouch.c, there is a possible out of bounds write ... In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-162844689References: Upstream kernel Scope: local bookworm:

CVE-2018-1068 [MEDIUM] CVE-2018-1068: linux - A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall inte... A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory. Scope: local bookworm: resolved (fixed in 4.15.11-1) bullseye: resolved (fixed in 4.15.11-1) forky: resolved (fixed in 4.15.11-1) sid: resolved (fixed in 4.15.11-1) trixie: resolved

CVE-2018-10840 [MEDIUM] CVE-2018-10840: linux - Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.... Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image. Scope: local bookworm: resolved (fixed in 4.17.3-1) bullseye: resolved (fixed in 4.17.3-1) forky: resolved (fixed in 4.17.3-1) sid: resolved (fixed in 4.17.3-1) trixie: resolve

CVE-2017-18551 [MEDIUM] CVE-2017-18551: linux - An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel befo... An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an out of bounds write in the function i2c_smbus_xfer_emulated. Scope: local bookworm: resolved (fixed in 4.14.17-1) bullseye: resolved (fixed in 4.14.17-1) forky: resolved (fixed in 4.14.17-1) sid: resolved (fixed in 4.14.17-1) trixie: resolved (fixed in 4.14.17-1)

CVE-2019-20636 [MEDIUM] CVE-2019-20636: linux - In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds write... In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds writes via a crafted keycode table, as demonstrated by input_set_keycode, aka CID-cb222aed03d7. Scope: local bookworm: resolved (fixed in 5.4.13-1) bullseye: resolved (fixed in 5.4.13-1) forky: resolved (fixed in 5.4.13-1) sid: resolved (fixed in 5.4.13-1) trixie: resolved (fixed in 5.4.13-1)

CVE-2020-12465 [MEDIUM] CVE-2020-12465: linux - An array overflow was discovered in mt76_add_fragment in drivers/net/wireless/me... An array overflow was discovered in mt76_add_fragment in drivers/net/wireless/mediatek/mt76/dma.c in the Linux kernel before 5.5.10, aka CID-b102f0c522cf. An oversized packet with too many rx fragments can corrupt memory of adjacent pages. Scope: local bookworm: resolved (fixed in 5.5.13-1) bullseye: resolved (fixed in 5.5.13-1) forky: resolved (fixed in 5.5.13-1) s

CVE-2014-8709 [MEDIUM] CVE-2014-8709: linux - The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before ... The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before 3.13.5 does not properly maintain a certain tail pointer, which allows remote attackers to obtain sensitive cleartext information by reading packets. Scope: local bookworm: resolved (fixed in 3.14.2-1) bullseye: resolved (fixed in 3.14.2-1) forky: resolved (fixed in 3.14.2-1) sid: resolved

CVE-2023-52447 [MEDIUM] CVE-2023-52447: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Defer ... In the Linux kernel, the following vulnerability has been resolved: bpf: Defer the free of inner map when necessary When updating or deleting an inner map in map array or map htab, the map may still be accessed by non-sleepable program or sleepable program. However bpf_map_fd_put_ptr() decreases the ref-counter of the inner map directly through bpf_map_put(), if the

CVE-2021-46953 [MEDIUM] CVE-2021-46953: linux - In the Linux kernel, the following vulnerability has been resolved: ACPI: GTDT:... In the Linux kernel, the following vulnerability has been resolved: ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure When failing the driver probe because of invalid firmware properties, the GTDT driver unmaps the interrupt that it mapped earlier. However, it never checks whether the mapping of the interrupt actially succeeded. Even more, shoul

CVE-2023-4394 [MEDIUM] CVE-2023-4394: linux - A use-after-free flaw was found in btrfs_get_dev_args_from_path in fs/btrfs/volu... A use-after-free flaw was found in btrfs_get_dev_args_from_path in fs/btrfs/volumes.c in btrfs file-system in the Linux Kernel. This flaw allows a local attacker with special privileges to cause a system crash or leak internal kernel information Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: resolved forky: resolved (fixed in 5.19.6-1) sid: resolved (fi

CVE-2020-29373 [MEDIUM] CVE-2020-29373: linux - An issue was discovered in fs/io_uring.c in the Linux kernel before 5.6. It unsa... An issue was discovered in fs/io_uring.c in the Linux kernel before 5.6. It unsafely handles the root directory during path lookups, and thus a process inside a mount namespace can escape to unintended filesystem locations, aka CID-ff002b30181d. Scope: local bookworm: resolved (fixed in 5.6.7-1) bullseye: resolved (fixed in 5.6.7-1) forky: resolved (fixed in 5.6.7-1

CVE-2022-45888 [MEDIUM] CVE-2022-45888: linux - An issue was discovered in the Linux kernel through 6.0.9. drivers/char/xillybus... An issue was discovered in the Linux kernel through 6.0.9. drivers/char/xillybus/xillyusb.c has a race condition and use-after-free during physical removal of a USB device. Scope: local bookworm: resolved (fixed in 6.1.119-1) bullseye: resolved forky: resolved (fixed in 6.3.7-1) sid: resolved (fixed in 6.3.7-1) trixie: resolved (fixed in 6.3.7-1)

CVE-2017-10911 [MEDIUM] CVE-2017-10911: linux - The make_response function in drivers/block/xen-blkback/blkback.c in the Linux k... The make_response function in drivers/block/xen-blkback/blkback.c in the Linux kernel before 4.11.8 allows guest OS users to obtain sensitive information from host OS (or other guest OS) kernel memory by leveraging the copying of uninitialized padding fields in Xen block-interface response structures, aka XSA-216. Scope: local bookworm: resolved (fixed in 4.11.11-1)

CVE-2018-10880 [MEDIUM] CVE-2018-10880: linux - Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem... Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service. Scope: local bookworm: resolved (fixed in 4.17.3-1) bullseye: resolved (fixed in 4.17.3-1) forky: resolved (fixed in 4.17.3-1)

CVE-2013-4350 [MEDIUM] CVE-2013-4350: linux - The IPv6 SCTP implementation in net/sctp/ipv6.c in the Linux kernel through 3.11... The IPv6 SCTP implementation in net/sctp/ipv6.c in the Linux kernel through 3.11.1 uses data structures and function calls that do not trigger an intended configuration of IPsec encryption, which allows remote attackers to obtain sensitive information by sniffing the network. Scope: local bookworm: resolved (fixed in 3.11.5-1) bullseye: resolved (fixed in 3.11.5-1) fo