Media
Monthly
A double-free in the Linux kernel's Intel IPU6 media driver (media: ipu6) occurs when the isys/psys auxiliary-device initialization fails and its error-unwinding path frees the platform data pointer a second time. Kernels built with the ipu6 bridge - introduced in Linux 6.10 and used on systems with Intel IPU6 / MIPI camera hardware - are affected, and reaching the flaw requires local, high-privileged access plus a specific driver-init failure (MMU initialization or auxiliary_device_add() failure) rather than an ordinary attacker-controlled syscall. No public exploit code has been identified at time of analysis; the assessed impact is limited to a low-availability fault (local, high privileges, high attack complexity) rather than the 7.8 score carried in the raw NVD feed.
moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign) character during. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.
A double-free in the Linux kernel's Intel IPU6 media driver (media: ipu6) occurs when the isys/psys auxiliary-device initialization fails and its error-unwinding path frees the platform data pointer a second time. Kernels built with the ipu6 bridge - introduced in Linux 6.10 and used on systems with Intel IPU6 / MIPI camera hardware - are affected, and reaching the flaw requires local, high-privileged access plus a specific driver-init failure (MMU initialization or auxiliary_device_add() failure) rather than an ordinary attacker-controlled syscall. No public exploit code has been identified at time of analysis; the assessed impact is limited to a low-availability fault (local, high privileges, high attack complexity) rather than the 7.8 score carried in the raw NVD feed.
moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign) character during. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.