Total
5666 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-51391 | 2024-04-18 | N/A | 7.5 HIGH | ||
| A bug in Micrium OS Network HTTP Server permits an invalid pointer dereference during header processing - potentially allowing a device crash and Denial of Service. | |||||
| CVE-2023-40551 | 2 Fedoraproject, Redhat | 3 Fedora, Enterprise Linux, Shim | 2024-04-18 | N/A | 5.1 MEDIUM |
| A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase. | |||||
| CVE-2023-40550 | 2 Fedoraproject, Redhat | 3 Fedora, Enterprise Linux, Shim | 2024-04-18 | N/A | 5.5 MEDIUM |
| An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase. | |||||
| CVE-2023-40549 | 2 Fedoraproject, Redhat | 3 Fedora, Enterprise Linux, Shim | 2024-04-18 | N/A | 5.5 MEDIUM |
| An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service. | |||||
| CVE-2023-40547 | 1 Redhat | 2 Enterprise Linux, Shim | 2024-04-18 | N/A | 8.3 HIGH |
| A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully. | |||||
| CVE-2024-26597 | 1 Linux | 1 Linux Kernel | 2024-04-17 | N/A | 7.1 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix global oob in rmnet_policy The variable rmnet_link_ops assign a *bigger* maxtype which leads to a global out-of-bounds read when parsing the netlink attributes. See bug trace below: ================================================================== BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline] BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 Read of size 1 at addr ffffffff92c438d0 by task syz-executor.6/84207 CPU: 0 PID: 84207 Comm: syz-executor.6 Tainted: G N 6.1.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x172/0x475 mm/kasan/report.c:395 kasan_report+0xbb/0x1c0 mm/kasan/report.c:495 validate_nla lib/nlattr.c:386 [inline] __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 __nla_parse+0x3e/0x50 lib/nlattr.c:697 nla_parse_nested_deprecated include/net/netlink.h:1248 [inline] __rtnl_newlink+0x50a/0x1880 net/core/rtnetlink.c:3485 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3594 rtnetlink_rcv_msg+0x43c/0xd70 net/core/rtnetlink.c:6091 netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0x154/0x190 net/socket.c:734 ____sys_sendmsg+0x6df/0x840 net/socket.c:2482 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fdcf2072359 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fdcf13e3168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fdcf219ff80 RCX: 00007fdcf2072359 RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003 RBP: 00007fdcf20bd493 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffbb8d7bdf R14: 00007fdcf13e3300 R15: 0000000000022000 </TASK> The buggy address belongs to the variable: rmnet_policy+0x30/0xe0 The buggy address belongs to the physical page: page:0000000065bdeb3c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x155243 flags: 0x200000000001000(reserved|node=0|zone=2) raw: 0200000000001000 ffffea00055490c8 ffffea00055490c8 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffffff92c43780: f9 f9 f9 f9 00 00 00 02 f9 f9 f9 f9 00 00 00 07 ffffffff92c43800: f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 06 f9 f9 f9 >ffffffff92c43880: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 ^ ffffffff92c43900: 00 00 00 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9 f9 ffffffff92c43980: 00 00 00 07 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 According to the comment of `nla_parse_nested_deprecated`, the maxtype should be len(destination array) - 1. Hence use `IFLA_RMNET_MAX` here. | |||||
| CVE-2019-25160 | 1 Linux | 1 Linux Kernel | 2024-04-17 | N/A | 7.1 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: netlabel: fix out-of-bounds memory accesses There are two array out-of-bounds memory accesses, one in cipso_v4_map_lvl_valid(), the other in netlbl_bitmap_walk(). Both errors are embarassingly simple, and the fixes are straightforward. As a FYI for anyone backporting this patch to kernels prior to v4.8, you'll want to apply the netlbl_bitmap_walk() patch to cipso_v4_bitmap_walk() as netlbl_bitmap_walk() doesn't exist before Linux v4.8. | |||||
| CVE-2024-32631 | 2024-04-16 | N/A | 7.2 HIGH | ||
| Out-of-Bounds read in ciCCIOTOPT in ASR180X will cause incorrect computations. | |||||
| CVE-2024-30401 | 2024-04-15 | N/A | 5.9 MEDIUM | ||
| An Out-of-bounds Read vulnerability in the advanced forwarding management process aftman of Juniper Networks Junos OS on MX Series with MPC10E, MPC11, MX10K-LC9600 line cards, MX304, and EX9200-15C, may allow an attacker to exploit a stack-based buffer overflow, leading to a reboot of the FPC. Through code review, it was determined that the interface definition code for aftman could read beyond a buffer boundary, leading to a stack-based buffer overflow. This issue affects Junos OS on MX Series and EX9200-15C: * from 21.2 before 21.2R3-S1, * from 21.4 before 21.4R3, * from 22.1 before 22.1R2, * from 22.2 before 22.2R2; This issue does not affect: * versions of Junos OS prior to 20.3R1; * any version of Junos OS 20.4. | |||||
| CVE-2023-33061 | 1 Qualcomm | 230 Ar8035, Ar8035 Firmware, Csr8811 and 227 more | 2024-04-12 | N/A | 7.5 HIGH |
| Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame. | |||||
| CVE-2023-33048 | 1 Qualcomm | 230 Ar8035, Ar8035 Firmware, Csr8811 and 227 more | 2024-04-12 | N/A | 7.5 HIGH |
| Transient DOS in WLAN Firmware while parsing t2lm buffers. | |||||
| CVE-2023-33047 | 1 Qualcomm | 356 Ar8035, Ar8035 Firmware, Ar9380 and 353 more | 2024-04-12 | N/A | 7.5 HIGH |
| Transient DOS in WLAN Firmware while parsing no-inherit IES. | |||||
| CVE-2023-33027 | 1 Qualcomm | 656 315 5g Iot Modem, 315 5g Iot Modem Firmware, 8098 and 653 more | 2024-04-12 | N/A | 7.5 HIGH |
| Transient DOS in WLAN Firmware while parsing rsn ies. | |||||
| CVE-2023-33016 | 1 Qualcomm | 132 Csr8811, Csr8811 Firmware, Fastconnect 6900 and 129 more | 2024-04-12 | N/A | 7.5 HIGH |
| Transient DOS in WLAN firmware while parsing MLO (multi-link operation). | |||||
| CVE-2023-33015 | 1 Qualcomm | 388 315 5g, 315 5g Firmware, Aqt1000 and 385 more | 2024-04-12 | N/A | 7.5 HIGH |
| Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame. | |||||
| CVE-2023-28571 | 1 Qualcomm | 172 8098, 8098 Firmware, 8998 and 169 more | 2024-04-12 | N/A | 5.5 MEDIUM |
| Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan. | |||||
| CVE-2023-28555 | 1 Qualcomm | 142 Ar8035, Ar8035 Firmware, Mdm9628 and 139 more | 2024-04-12 | N/A | 7.5 HIGH |
| Transient DOS in Audio while remapping channel buffer in media codec decoding. | |||||
| CVE-2023-28543 | 1 Qualcomm | 8 Qcs405, Qcs405 Firmware, Qcs605 and 5 more | 2024-04-12 | N/A | 9.8 CRITICAL |
| A malformed DLC can trigger Memory Corruption in SNPE library due to out of bounds read, such as by loading an untrusted model (e.g. from a remote source). | |||||
| CVE-2023-28542 | 1 Qualcomm | 376 315 5g Iot, 315 5g Iot Firmware, Apq8064au and 373 more | 2024-04-12 | N/A | 7.8 HIGH |
| Memory Corruption in WLAN HOST while fetching TX status information. | |||||
| CVE-2023-28541 | 1 Qualcomm | 398 Aqt1000, Aqt1000 Firmware, Ar8031 and 395 more | 2024-04-12 | N/A | 7.8 HIGH |
| Memory Corruption in Data Modem while processing DMA buffer release event about CFR data. | |||||