Debian Linux vulnerabilities

CVE-2014-4943 [MEDIUM] CVE-2014-4943: linux - The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 a... The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket. Scope: local bookworm: resolved (fixed in 3.14.13-1) bullseye: resolved (fixed in 3.14.13-1) forky: resolved (fixed in 3.14.13-1) sid: resolved (fixed in 3.14.13-1) trix

CVE-2023-32254 [CRITICAL] CVE-2023-32254: linux - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB s... A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel. Scope: local book

CVE-2019-14896 [CRITICAL] CVE-2019-14896: linux - A heap-based buffer overflow vulnerability was found in the Linux kernel, versio... A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. A remote attacker could cause a denial of service (system crash) or, possibly execute arbitrary code, when the lbs_ibss_join_existing function is called after a STA connects to an AP. Scope: local bookworm: resolved (fixed in 5.4.19-1) bull

CVE-2013-4579 [MEDIUM] CVE-2013-4579: linux - The ath9k_htc_set_bssid_mask function in drivers/net/wireless/ath/ath9k/htc_drv_... The ath9k_htc_set_bssid_mask function in drivers/net/wireless/ath/ath9k/htc_drv_main.c in the Linux kernel through 3.12 uses a BSSID masking approach to determine the set of MAC addresses on which a Wi-Fi device is listening, which allows remote attackers to discover the original MAC address after spoofing by sending a series of packets to MAC addresses with certain b

CVE-2022-47942 [HIGH] CVE-2022-47942: linux - An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.... An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is a heap-based buffer overflow in set_ntacl_dacl, related to use of SMB2_QUERY_INFO_HE after a malformed SMB2_SET_INFO_HE command. Scope: local bookworm: resolved (fixed in 5.19.6-1) bullseye: resolved forky: resolved (fixed in 5.19.6-1) sid: resolved (fixed in 5.19.6-1) trixi

CVE-2019-16746 [CRITICAL] CVE-2019-16746: linux - An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.... An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of variable elements in a beacon head, leading to a buffer overflow. Scope: local bookworm: resolved (fixed in 5.3.7-1) bullseye: resolved (fixed in 5.3.7-1) forky: resolved (fixed in 5.3.7-1) sid: resolved (fixed in 5.3.7-1) trixie: resolved (fixed i

CVE-2019-9213 [MEDIUM] CVE-2019-9213: linux - In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check ... In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task. Scope: local bookworm: resolved (fixed in 4.19.28-1) bullseye: resolved (fixed in 4.19.28-1) forky:

CVE-2019-1125 [MEDIUM] CVE-2019-1125: linux - An information disclosure vulnerability exists when certain central processing u... An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory. An attacker who successfully exploited the vulnerability could read privileged data across trust boundaries. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerabil

CVE-2024-53095 [HIGH] CVE-2024-53095: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client... In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free of network namespace. Recently, we got a customer report that CIFS triggers oops while reconnecting to a server. [0] The workload runs on Kubernetes, and some pods mount CIFS servers in non-root network namespaces. The problem rarely happened, but it was always while th

CVE-2026-23455 CVE-2026-23455: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ... In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protocol discriminator byte before passing it to DecodeH323_UserInformation(). If the encoded length is 0, the decrement wra

CVE-2020-0009 [MEDIUM] CVE-2020-0009: linux - In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared ... In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This could lead to local escalation of privilege by corrupting memory shared between processes, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-14293

CVE-2019-10126 [CRITICAL] CVE-2019-10126: linux - A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_ua... A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly other consequences. Scope: local bookworm: resolved (fixed in 4.19.37-4) bullseye: resolved (fixed in 4.19.37-4) forky: resolved (fixed in 4.19.37-4) sid: resolved (fixed

CVE-2023-32250 [CRITICAL] CVE-2023-32250: linux - A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB s... A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel. Scope: local bookwo

CVE-2014-2523 [CRITICAL] CVE-2014-2523: linux - net/netfilter/nf_conntrack_proto_dccp.c in the Linux kernel through 3.13.6 uses ... net/netfilter/nf_conntrack_proto_dccp.c in the Linux kernel through 3.13.6 uses a DCCP header pointer incorrectly, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a DCCP packet that triggers a call to the (1) dccp_new, (2) dccp_packet, or (3) dccp_error function. Scope: local bookworm: resolved (fixed

CVE-2016-4558 [HIGH] CVE-2016-4558: linux - The BPF subsystem in the Linux kernel before 4.5.5 mishandles reference counts, ... The BPF subsystem in the Linux kernel before 4.5.5 mishandles reference counts, which allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted application on (1) a system with more than 32 Gb of memory, related to the program reference count or (2) a 1 Tb system, related to the map reference count. Scope: l

CVE-2017-7895 [CRITICAL] CVE-2017-7895: linux - The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 l... The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c. Scope: local bookworm: resolved (fixed in 4.9.25-1) bullseye:

CVE-2019-14897 [CRITICAL] CVE-2019-14897: linux - A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.... A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An attacker is able to cause a denial of service (system crash) or, possibly execute arbitrary code, when a STA works in IBSS mode (allows connecting stations together without the use of an AP) and connects to another STA. Scope: local bookworm: resolve

CVE-2025-27558 [LOW] CVE-2025-27558: linux - IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. I... IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP), an adversary can exploit this vulnerability to inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames. NOTE: this issue exists because of an incorrect fix for C

CVE-2024-26594 [HIGH] CVE-2024-26594: linux - In the Linux kernel, the following vulnerability has been resolved: ksmbd: vali... In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate mech token in session setup If client send invalid mech token in session setup request, ksmbd validate and make the error if it is invalid. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: resolved forky: resolved (fixed in 6.6.15-1) sid: resolved (fixed in 6.6.15-1) trixi

CVE-2023-38428 [CRITICAL] CVE-2023-38428: linux - An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ... An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly check the UserName value because it does not consider the address of security buffer, leading to an out-of-bounds read. Scope: local bookworm: resolved (fixed in 6.1.37-1) bullseye: resolved forky: resolved (fixed in 6.3.7-1) sid: resolved (fixed in 6.3.7-1) tri