Uninitialized memory access in the Linux kernel's netfilter xt_hashlimit module allows local users with netfilter rule configuration privileges to read uninitialized kernel memory and potentially corrupt rate-limiting state. The flaw exists in the .checkentry validation path, which failed to detect when XT_HASHLIMIT_RATE_MATCH mode is applied across multiple rules sharing the same hashtable, leaving the burst field in the dsthash_ent union uninitialized. No public exploit or CISA KEV listing exists at time of analysis; an EPSS score of 0.16% reflects low near-term exploitation probability.
SQL Injection in WPML Multilingual CMS for WordPress allows authenticated attackers holding translator-level access or above to extract sensitive information from the underlying database on all plugin versions through 4.9.5. The vulnerable code resides in the Translation Manager REST API's job-ordering logic - specifically the unsanitized 'sorting' parameter processed by OrderQueryHelper - where user-supplied input is appended to existing SQL queries without adequate escaping or prepared-statement protections. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the translator role is routinely provisioned on multilingual WordPress sites, making the authenticated barrier lower than it may appear from the CVSS score alone.
SQL injection in the Groundhogg WordPress CRM plugin (versions through 4.5.14) permits authenticated attackers holding vendor-level or higher access to append arbitrary SQL to database queries via the insufficiently escaped 'tag_query' parameter, resulting in full read-access to the WordPress database. The exploitation path is non-trivial: the attacker must deliberately force execution into the deprecated Legacy_Contact_Query handler by submitting an unknown filter type that triggers a FilterException, bypassing the modern query handler's protections. No public exploit has been identified at time of analysis, and the vendor has issued a code fix (SVN changeset 3643654), though the exact patched release version is not independently confirmed in available data.
Second-order SQL injection in the Contest Gallery WordPress plugin (all versions through 30.0.7) allows authenticated attackers with author-level access to append arbitrary SQL into backend queries via the `cgRealId` parameter within the `cg_multiple_files_for_post` upload mechanism. The injected payload is first stored in the database without adequate sanitization and later executed unsafely by backend AJAX handlers in `ajax/ajax-functions-backend.php` and gallery administration scripts, enabling extraction of sensitive information from the WordPress database. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
SQL Injection in the KiviCare Clinic & Patient Management System (EHR) WordPress plugin through version 4.5.1 exposes sensitive healthcare database contents to authenticated low-privilege users. The unsanitized 'searchTerm' parameter in SettingsController/ListingData.php (lines 69, 442, 456) is interpolated directly into SQL queries without parameterization, enabling arbitrary data extraction from the underlying WordPress database - including patient records, clinical data, and credential hashes. Exploitation is constrained to KiviCare custom roles bearing the 'settings_view' permission (e.g., Doctor, Receptionist), limiting but not eliminating insider-threat and compromised-account scenarios. No public exploit identified at time of analysis and no CISA KEV listing confirmed.
SQL injection in the Image Uploader for Welcart WordPress plugin (all versions up to and including 1.4.6) allows authenticated attackers holding author-level access or above to exfiltrate sensitive data from the WordPress database by appending arbitrary SQL to queries constructed around the unsanitized 'post_title' parameter. The root cause is the absence of both input escaping and prepared statement usage in the plugin's database interaction code, confirmed by Wordfence with direct source code references. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low authentication bar makes this a credible risk on any multi-author Welcart installation.
Cross-site privilege escalation in the Backup Migration WordPress plugin (versions before 2.1.7) exposes WordPress multisite networks to unauthorized administrative access. A sub-site administrator can exploit an improperly restricted post-restore automatic login mechanism to obtain a persistent, long-lived authenticated session as an administrator of a separate site within the same network - without supplying credentials and bypassing any two-factor authentication controls in place on the target site. No public exploit code has been identified at time of analysis, and EPSS sits at 0.18% (8th percentile), indicating low current exploitation probability despite the high confidentiality and integrity impact.
Unauthorized user enumeration in the Simply Schedule Appointments WordPress plugin before 1.6.12.17 allows authenticated staff-role users to retrieve names and email addresses of all registered users via insufficiently scoped REST API endpoints. The vulnerability stems from missing authorization checks that should limit returned user records to those the requester is permitted to view. No public exploit has been identified and EPSS sits at 0.14% (4th percentile), indicating low exploitation probability, though the confidentiality impact is rated High due to unrestricted PII exposure.
Stored Cross-Site Scripting in Beaver Builder Page Builder for WordPress (all versions up to and including 2.10.2.2) allows authenticated users at Author level or above to permanently inject arbitrary JavaScript via the Button Module's Button Code field. The injected payload executes in any visitor's browser upon loading the affected page, enabling session hijacking, credential theft, or drive-by malware delivery across the site's entire visitor population. No active exploitation is confirmed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified at the time of analysis.
Stored Cross-Site Scripting in the Hydra Booking WordPress plugin (all versions ≤ 1.2.2) allows injection of arbitrary web scripts via the unsanitized `first_name` parameter in host profiles, with payloads executing against any visitor who loads the affected host archive pages. Although the CVSS vector assigns PR:L, the plugin's public Signup shortcode permits any site visitor to self-register as a `tfhb_host`, collapsing the practical exploitation barrier to effectively unauthenticated. No CISA KEV listing or public exploit code has been identified at time of analysis, and an upstream fix commit (SVN changeset 3632543) is available in the WordPress plugin repository.
Insufficient entropy in API key generation for pkp/pkp-lib 3.3.0, 3.4.0, and 3.5.0 exposes generated API keys to brute-force prediction. The vulnerable code derived API keys using SHA1 of the current Unix timestamp (sha1(time())), which yields a deterministic, low-entropy value easily narrowed to a small candidate window if the approximate key-generation time is known or guessable. No public exploit or CISA KEV listing exists at time of analysis, but the upstream fix commit (529b5df) is publicly visible and the flaw is self-evident from the diff.
Information disclosure in Shescape, a Node.js shell-argument escaping library, affects versions before 2.1.15 and the 3.0.x line before 3.0.2 when the library's escape/escapeAll output is placed in a shell variable assignment and the runtime shell is explicitly set to "sh" (or true) with /bin/sh symlinked to BusyBox. Under those conditions an attacker who controls the escaped input can inject an unescaped tilde (~) that BusyBox expands, revealing the user's home directory path and, depending on how the assignment feeds the command, redirecting the filesystem location a command targets. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix is delivered via an upstream commit and tagged releases 2.1.15 and 3.0.2.
Missing encryption of sensitive data in TRENDnet TEW-WLC100 (firmware 2.05b02) exposes VPN negotiation material when the racoon IKE daemon is configured to use IKE Phase 1 Aggressive Mode. An unauthenticated remote attacker positioned on the network path can passively intercept Aggressive Mode handshake traffic, capturing identity information and pre-shared key (PSK) hashes in cleartext, which are then subject to offline cracking. No public exploit code or CISA KEV listing has been identified at time of analysis; CVSS 4.0 rates this at 6.3 (Medium) with AC:H, reflecting the elevated complexity needed to intercept IKE traffic.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/viewmedicine.php` endpoint to database manipulation via the unsanitized `delid` parameter, allowing remote low-privileged attackers to read, alter, or delete hospital database contents including patient and medication records. A public proof-of-concept exploit is confirmed available on GitHub, lowering the bar for exploitation significantly. No vendor-released patch exists, making manual code remediation or decommissioning the only available mitigations.
Direct unauthenticated access to a SQL database backup file exposes sensitive data in SourceCodester Online Clothing Store 1.0. The file /db/shopping.sql is placed within a web-accessible directory with no access restriction, allowing any remote attacker to download the full database backup by issuing a direct HTTP request. Based on the publicly disclosed Medium write-up, the exposed backup contains administrative credentials, meaning exploitation can serve as a stepping stone to full application compromise. A proof-of-concept has been publicly disclosed; no public active exploitation (CISA KEV) has been confirmed.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_teacher.php` endpoint to unauthenticated remote exploitation via an unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms low-complexity, unauthenticated, network-accessible exploitation with partial confidentiality, integrity, and availability impact. A public proof-of-concept exploit exists (E:P in CVSS 4.0 threat metrics); no vendor-released patch has been identified at time of analysis.
SQL injection in Jinher OA 1.0 exposes the attendance approval endpoint to unauthenticated remote attackers via the unvalidated `httpOID` parameter in `/C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx`. Publicly available exploit code exists, lowering the bar for exploitation significantly. The vendor was notified prior to disclosure but did not respond, meaning no official patch has been issued.
Stored cross-site scripting in the ECS WordPress plugin before 4.3.8 allows a Contributor-level user to inject arbitrary JavaScript into any post - including administrator-authored pages - by exploiting missing authorization and object-ownership checks on the Dynamic Repeater AJAX handlers. The plugin gates these endpoints solely with a capability-agnostic nonce distributed through the Elementor editor, making them reachable by any edit_posts user who can then write unsanitized data-source bindings that execute in the browser of any visitor or administrator who views the affected page. No public exploit has been confirmed and EPSS sits at 0.15% (5th percentile), but the low privilege bar and potential to chain into admin account takeover make patching to 4.3.8 a straightforward and time-sensitive action.
Login CSRF in @fastify/oauth2 versions 7.2.0 through 8.2.x allows an attacker controlling a sibling subdomain to plant predictable OAuth state and PKCE code verifier cookies, silently signing a victim into the attacker's account instead of their own. The root cause is the absence of server-side session binding and cookie prefixing - the plugin validates OAuth state exclusively by comparing callback parameters against unprefixed cookies, which sibling subdomains sharing the same registrable domain can freely overwrite. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept exists; the high attack complexity limits opportunistic risk.
Price manipulation in the Pinpoint Booking System - Version 2 WordPress plugin (all versions ≤2.9.9.6.8) enables unauthenticated remote attackers to purchase any WooCommerce bookable product at a self-chosen price by injecting an arbitrary `price_total` value into the `cart_data` POST parameter. The vulnerable `dopbsp_woocommerce_add_to_cart` AJAX handler - registered via `wp_ajax_nopriv_*` with no authentication and no nonce check - persists the attacker-supplied price directly to the database and a subsequent WooCommerce hook reads it back to set the product price without recalculation. No public exploit has been identified at time of analysis, though the code paths are fully visible in the public WordPress plugin repository, materially lowering the barrier to exploitation.
Authorization bypass in the wpdevart Booking Calendar, Appointment Booking System plugin for WordPress (all versions through 3.2.36) permits unauthenticated remote attackers to write attacker-controlled payment status and transaction data directly into the plugin's payments database table, bypassing any payment gateway verification. This enables fraudulent marking of reservations as paid or completed, cancellation of legitimate customer payments, and dispatch of transactional booking confirmation emails to arbitrary parties. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Blind SQL injection in the Form Maker by 10Web WordPress plugin exposes full database read access to authenticated subscriber-level attackers through a two-stage exploitation path involving profile manipulation and a crafted AJAX request. All plugin versions through 1.15.44 are affected per Wordfence's disclosure, with specific vulnerable code paths confirmed at multiple locations in WDW_FM_Library.php and the plugin's frontend controllers. No public exploit code has been identified at time of analysis, and exploitation is gated behind a non-default form configuration, substantially limiting mass exploitation risk despite the C:H confidentiality rating.
Unauthorized disclosure of unpublished Elementor content affects the ECS WordPress plugin before version 4.3.8, allowing any unauthenticated internet user to retrieve the fully rendered HTML of private, draft, or pending Elementor documents by supplying a valid post identifier to a plugin AJAX endpoint. The plugin's AJAX handler for rendering Elementor documents performs no post-status check and enforces no WordPress capability, completely bypassing the platform's native visibility controls for those requests. No public exploit code has been identified and EPSS is 0.15% (5th percentile), indicating low observed exploitation probability, though the zero-authentication requirement makes the attack trivially automatable against enumerable sequential post IDs.
SQL injection in the Invisible Anti-Spam & CAPTCHA - reCAPTCHA Alternative for All Forms WordPress plugin (all versions through 5.1) exposes WordPress database contents to authenticated attackers holding editor-level or higher roles. The 'key' parameter in plugin admin functionality lacks sufficient escaping and prepared-statement handling, allowing appended SQL to read arbitrary database tables. No public exploit exists and the vulnerability is not listed in CISA KEV; exploitation is constrained by the high privilege requirement, keeping real-world risk moderate despite the high confidentiality impact.
SQL Injection in the 'Invisible Anti-Spam & CAPTCHA - reCAPTCHA Alternative for All Forms' WordPress plugin (all versions through 5.1) permits authenticated users holding editor-level or higher WordPress roles to append arbitrary SQL clauses to existing database queries via unsanitized Pattern JSON keys and values. The attack yields full read access to the WordPress database - including user credentials, PII, and configuration data - while carrying no integrity or availability impact per the CVSS vector (I:N, A:N). No public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
Cross-request data leakage in Apache Struts 7.2.1's JSON plugin allows an authenticated remote attacker to observe response content associated with a concurrent request belonging to a different user. The root cause is a thread-safety defect (CWE-567) in the SMD/JSON-RPC interceptor, where per-response serialization state is not isolated between concurrent requests. Exploitation is constrained to the non-default SMD/JSON-RPC mode of the JSON interceptor; no public exploit code has been identified at time of analysis, and the EPSS score of 0.15% (4th percentile) reflects the limited realistic exploitation surface.
Cross-request data exposure in the Apache Struts JSON plugin (version 7.2.1) results from per-request parsing state being improperly shared across concurrent requests, enabling information observable in one user's session to leak into another's. Authenticated remote attackers targeting applications that have explicitly enabled JSON action population can exploit this concurrency flaw (CWE-567) to read partial request data or circumvent configured parsing limits. With an EPSS of 0.15% (4th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world risk is low and narrowed further by the non-default plugin requirement.
Missing authorization on ECS WordPress plugin's dynamic repeater actions (versions before 4.3.8) allows any contributor-level account or above to read, alter, and delete binding configurations of posts they do not own, and to overwrite site-wide plugin presets. The plugin relies solely on a nonce for these actions - a token available to anyone who can open the page builder - without performing capability or ownership checks (CWE-862). No public exploit has been identified at time of analysis, and the EPSS score of 0.13% (3rd percentile) indicates very low current exploitation probability; however, the attack requires only a standard contributor account, making multi-author WordPress sites the primary risk surface.
VMAuth, the authentication proxy component of VictoriaMetrics through version 1.146.0, fails to restrict the rate of authentication attempts in its requestHandler function, enabling remote brute-force attacks against credentials protecting proxied metrics backends. The missing delay or lockout mechanism allows an attacker to enumerate credential combinations at network speed with no server-side throttling. Publicly available exploit code exists (CVSS 4.0 E:P supplemental), though this CVE does not appear in the CISA KEV catalog and real-world exploitation risk is tempered by the high attack complexity rating.
Unbounded authentication attempts against Open Source Point of Sale (versions 3.4.0-3.4.2) allow remote attackers to brute-force user credentials via the login endpoint without triggering any lockout or throttle. The Login::index function in app/Config/Validation/OSPOSRules.php performs no rate limiting on failed authentication attempts, leaving all user accounts exposed to automated credential guessing. Publicly available exploit code exists (CVSS 4.0 E:P); the vulnerability is not listed in CISA KEV, and the official upstream project has not yet responded to the responsible disclosure.
Brute-force authentication bypass in dtale (man-group) up to version 3.22.0 allows remote attackers to submit unlimited login attempts against the Login Endpoint in dtale/auth.py due to the absence of rate limiting or account lockout controls (CWE-307). The CVSS 4.0 score of 2.9 reflects high attack complexity and limited confidentiality impact, consistent with the description's characterization of exploitation as difficult. Publicly available exploit code exists (CVSS 4.0 E:P modifier), and no vendor patch has been released - the project has not responded to the coordinated disclosure via GitHub issue.
Weak session key generation in dtale up to version 3.22.0 allows remote attackers with network access and session cookie capture capability to predict or brute-force the Flask SECRET_KEY and subsequently forge session cookies. The build_secret_key function in dtale/app.py generates a 10-character key using NumPy's non-cryptographic PRNG over a 36-character alphabet, yielding severely insufficient entropy for a security-sensitive value. Publicly available exploit code exists per the CVE description and corroborated by CVSS 4.0 E:P, but no active exploitation has been confirmed by CISA KEV; an upstream fix PR has been submitted but not yet merged.
Incorrect default permissions in the vsftpd FTP service on D-Link DIR-842 firmware 2.01.B04 allow a remotely authenticated low-privileged attacker to achieve limited integrity impact under high-complexity conditions via manipulation of /etc/vsftpd.conf. The vulnerability carries a CVSS 4.0 score of 2.3, placing it in the low-severity tier with no active exploitation confirmed (not in CISA KEV) and no public exploit code identified at time of analysis. The discrepancy between the 'Information Disclosure' tag and the CVSS showing no confidentiality impact (VC:N) introduces some ambiguity about the full impact scope.
SQL injection in code-projects Online Food Order System 1.0 allows remote authenticated attackers to manipulate the `checkbox` parameter in delete_food_items1.php to inject arbitrary SQL into the backend database. A proof-of-concept exploit has been publicly published on GitHub, and the CVSS 4.0 score of 2.1 reflects bounded confidentiality, integrity, and availability impact limited to the application's data scope. No CISA KEV listing and no vendor patch have been identified; this appears to be a researcher-reported vulnerability in niche academic software with negligible enterprise deployment.
Cross-site scripting in code-projects Online Food Order System 1.0 allows authenticated remote attackers to inject malicious scripts via the dname parameter in edit_food_items.php. When a separate victim user views the manipulated food item entry, the injected script executes within their browser session. Publicly available exploit code exists per a GitHub proof-of-concept, though no active exploitation has been confirmed by CISA KEV.
Stored cross-site scripting in SourceCodester Online Book Store System 1.0 allows a high-privileged authenticated attacker to inject malicious JavaScript via the System Settings Module at /admin/index.php?page=site_settings, which subsequently executes in the browser of any user who loads the affected settings page. A public proof-of-concept has been disclosed (CVSS 4.0 E:P modifier confirmed), though the CVSS 4.0 base score of 1.9 reflects the significant constraint of requiring prior administrative access. No active exploitation has been identified in CISA KEV, and no vendor-issued patch is confirmed at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump inet6_dump_fib() saves its progress in cb->args[1] as a positional index within the current hash chain. Between batches, a concurrent fib6_new_table() can insert a new table at the chain head, shifting all existing entries. The saved index then lands on a different table, causing fib6_dump_table() to set w->root to the wrong table while w->node still points into the previous one. fib6_walk_continue() dereferences w->node->parent (NULL) and panics: BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:fib6_walk_continue+0x6e/0x170 Call Trace: <TASK> fib6_dump_table.isra.0+0xc5/0x240 inet6_dump_fib+0xf6/0x420 rtnl_dumpit+0x30/0xa0 netlink_dump+0x15b/0x460 netlink_recvmsg+0x1d6/0x2a0 ____sys_recvmsg+0x17a/0x190 Fix by storing tb->tb6_id in cb->args[1] instead of a positional index. On resume, skip entries until the id matches; a concurrent head-insert can never match the saved id, so the walker always resumes on the correct table.
In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Only report alarms if driver is ready Userspace can read sysfs attributes before driver registration is complete, immediately after devm_hwmon_device_register_with_info() has been called. At that time, data->hwmon_dev is not yet initialized. This can trigger a NULL pointer access since lm90_update_device() and with it lm90_update_alarms_locked() will be called. This call schedules report_work and lm90_report_alarms(), which passes the still-NULL data->hwmon_dev to hwmon_notify_event() and triggers a NULL pointer dereference. Fix the problem by only scheduling the report and alert workers data->hwmon_dev is set.
In the Linux kernel, the following vulnerability has been resolved: hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread When userspace configures 'auto_update_interval' to 0 via sysfs, the background kthread executes schedule_timeout_interruptible(0), which returns immediately. If 'num_temp_sensors' is concurrently or previously set to 0, the msleep_interruptible() delay inside adt7470_read_temperatures() also becomes 0. This combination forces the background thread into a tight, unbounded busy-loop, hogging the CPU and flooding the I2C bus with a continuous stream of transactions. Fix this vulnerability by raising the lower limit of the clamp_val in auto_update_interval_store() from 0 to 500 milliseconds. This guarantees a reasonable minimum sleep window between sensor updates, protecting the system from intentional or accidental I2C bus denial of service.
In the Linux kernel, the following vulnerability has been resolved: hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read If the fan data becomes 0 between the FAN_DATA_VALID() check and the FAN_PERIOD_TO_RPM() conversion, it will result in a divide-by-zero crash due to a race with a concurrent update of the cached fan value. Fix a TOCTOU issue by reading fan data once.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Validate length before parsing diagnostics TLV btintel_diagnostics() accesses tlv->val[0] without first validating that the diagnostics VSE is long enough to contain that field, so may cause reading data beyond the received frame. Fix by validating the length before access.
In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: free TX rings on RX allocation failure When RX descriptor ring allocation fails, init_dma_desc_rings() only frees the partially allocated RX rings and returns. The TX rings that were allocated earlier in the same function are leaked. Rearrange error labels to clean up TX rings upon RX failures.
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix use-after-free in ump_to_endpoint() create_midi2_ump() registers a card-owned snd_ump_endpoint and stores a back-pointer to its per-interface snd_usb_midi2_ump object in ump->private_data, but it never installs an ump->private_free hook and never clears that pointer. If a later step of snd_usb_midi_v2_create() fails, its error path calls free_all_midi2_umps(), which kfree()s the snd_usb_midi2_ump object while the already-registered endpoint keeps pointing at it. The created /dev/snd/umpC*D* node stays exposed, so the first operation of any UMP open, ump_to_endpoint(), dereferences the dangling ump->private_data and reads rmidi->eps[dir] out of freed memory. A malicious USB MIDI 2.0 device that makes creation fail after the endpoint is registered can thus trigger a slab use-after-free read on a subsequent open of the UMP node. Clear the endpoint's back-pointer before freeing the object, and let ump_to_endpoint() tolerate a NULL private_data so the open/close/trigger callbacks fail cleanly (their callers already handle a NULL endpoint) instead of dereferencing a stale pointer. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() snd_usbmidi_akai_output() computes its fill-loop bound buf_end = ep->max_transfer - MAX_AKAI_SYSEX_LEN - 1; as a signed int, so a small device-advertised bulk-OUT max_transfer makes buf_end negative. The loop guard then compares the u32 urb->transfer_buffer_length against that negative int: the usual arithmetic conversion turns buf_end into a large unsigned value, so the guard stays true and each iteration keeps appending SysEx framing and payload bytes past the end of the URB transfer buffer, which is only max_transfer bytes long. A USB device that advertises a tiny bulk-OUT endpoint can therefore trigger an attacker-length- and content-controlled heap out-of-bounds write when a process writes to the created /dev/snd/midiC*D* node. Return early when there is no room for even one SysEx, so the loop is never entered with a bound that would wrap. The loop is the last statement of the function, so bailing out is equivalent to it not running. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set When a USB audio endpoint requests full packet transfers via the fill_max descriptor flag, data_ep_set_params() promotes ep->curpacksize to ep->maxpacksize. However, maxsize is left at the original sample-rate derived value. Since u->buffer_size is allocated as maxsize * packets, the resulting DMA buffer is far too small for the requested transfer length. When the USB host controller streams up to curpacksize bytes per packet, it writes past the end of the buffer via DMA, corrupting kernel heap memory. Update maxsize to curpacksize when fill_max is set so that the allocated DMA buffer size matches the actual transfer request size. [ changed to reassign maxsize only when ep->fill_max is set -- tiwai ]
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix skb leak on flow key update failure during ct ovs_ct_execute() always steals or frees the skb on failure while ovs_flow_key_update() does not. So, if it fails and we return right away, the skb ends up leaked. Fix that by breaking instead and letting the common error handling code at the bottom of the loop to free the skb properly. This is a very unlikely scenario as it requires the packet to become unparseable by applying a set of actions on a previously parseable skb, but should be fixed nevertheless. Reported by Sashiko.
In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: validate CPC message lengths ems_usb_read_bulk_callback() walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the fields used by the CAN, state, error and overrun handlers.
In the Linux kernel, the following vulnerability has been resolved: can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMD_HEADER_LEN can still be dispatched, and the wait path copies a matching command into a fixed caller-owned struct kvaser_cmd using the device-provided length. Reject nonzero commands that do not contain the fixed header or that extend beyond the current USB buffer item. In the wait path, also reject a matching command that exceeds the destination before copying it.
In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: add bounds check for USB channel index The channel control index ctrl_idx is derived from rx->len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usb_if->dev[] is only 2. Values 2-15 cause heap out-of-bounds read, eventually causing kernel panic in the IRQ context. Add bounds checking for ctrl_idx before the array access in both pcan_usb_pro_handle_canmsg() and pcan_usb_pro_handle_error().
In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: validate uCAN receive record lengths pcan_usb_fd_decode_buf() walks uCAN records packed in one USB receive buffer. Require each record to contain the fixed header for its type, and verify CAN payload bytes before copying them into the skb.