Week: 2024-W41

RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08

2024-10-08 CVE-2024-47750

RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency

2024-10-08 CVE-2024-47696

RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds

2024-10-08 CVE-2024-47695

RDMA/rtrs-srv: Avoid null pointer deref during path establishment

2024-10-08 CVE-2024-50062

Remote Desktop Client Remote Code Execution Vulnerability

2024-10-08 CVE-2024-43533

Remote Desktop Client Remote Code Execution Vulnerability

2024-10-08 CVE-2024-43599

Remote Desktop Protocol Server Remote Code Execution Vulnerability

2024-10-08 CVE-2024-43582

Remote Registry Service Elevation of Privilege Vulnerability

2024-10-08 CVE-2024-43532

resource: fix region_intersects() vs add_memory_driver_managed()

2024-10-08 CVE-2024-49878

REXML ReDoS vulnerability

2024-10-08 CVE-2024-49761

scsi: pm80xx: Set phy->enable_completion only when we wait for it

2024-10-08 CVE-2024-47666

smb: client: fix UAF in async decryption

2024-10-08 CVE-2024-50047

spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware

2024-10-08 CVE-2024-47664

static_call: Handle module init failure correctly in static_call_del_module()

2024-10-08 CVE-2024-50002

static_call: Replace pointless WARN_ON() in static_call_module_notify()

2024-10-08 CVE-2024-49954

Sudo for Windows Spoofing Vulnerability

2024-10-08 CVE-2024-43571

tcp: check skb is non-NULL in tcp_rto_delta_us()

2024-10-08 CVE-2024-47684

tcp: fix mptcp DSS corruption due to large pmtu xmit

2024-10-08 CVE-2024-50083

The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion `v0.0.0-20240729232818-a2a9c4f`, which correspo

2024-10-08 CVE-2024-44337

The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.

2024-10-08 CVE-2024-48949

criticalMicrosoft MSRC 2024-W41

thermal: core: Reference count the zone in thermal_zone_get_by_id()

2024-10-08 CVE-2024-50028

TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.

2024-10-08 CVE-2024-50614

TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/digit, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.

2024-10-08 CVE-2024-50615

tipc: guard against string buffer overrun

2024-10-08 CVE-2024-49995

tty: n_gsm: Fix use-after-free in gsm_cleanup_mux

2024-10-08 CVE-2024-50073

ublk: don't allow user copy for unprivileged device

2024-10-08 CVE-2024-50080

Unbounded name compression could lead to Denial of Service

2024-10-08 CVE-2024-8508

uprobe: avoid out-of-bounds memory access of fetching args

2024-10-08 CVE-2024-50067

usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c

2024-10-08 CVE-2024-50056

use-after-free when closing buffers in Vim

2024-10-08 CVE-2024-47814

vfs: fix race between evice_inodes() and find_inode()&iput()

2024-10-08 CVE-2024-47679

vhost_vdpa: assign irq bypass producer token correctly

2024-10-08 CVE-2024-47748

Virtual environment (venv) activation scripts don't quote paths

2024-10-08 CVE-2024-9287

Visual C++ Redistributable Installer Elevation of Privilege Vulnerability

2024-10-08 CVE-2024-43590

Visual Studio Code extension for Arduino Remote Code Execution Vulnerability

2024-10-08 CVE-2024-43488

Visual Studio Code for Linux Remote Code Execution Vulnerability

2024-10-08 CVE-2024-43601

Visual Studio Collector Service Denial of Service Vulnerability

2024-10-08 CVE-2024-43603

Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and 9.0.1 and pr

2024-10-08 CVE-2024-21247

Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and 9.0.1 and prio

2024-10-08 CVE-2024-21231

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.38 and prior 8.4.1 and prior and 9.0.1 and prior. Easily

2024-10-08 CVE-2024-21207

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and 9.0.1 and prior. Easily

2024-10-08 CVE-2024-21194

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and 9.0.1 and prior. Easily

2024-10-08 CVE-2024-21199

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and 9.0.1 and prior. Easily

2024-10-08 CVE-2024-21213

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and 9.0.1 and prior. Easily

2024-10-08 CVE-2024-21218

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and 9.0.1 and prior. Easily

2024-10-08 CVE-2024-21236

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and 9.0.1 and prior. Easily

2024-10-08 CVE-2024-21239

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and 9.0.1 and prior. E

2024-10-08 CVE-2024-21198

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and 9.0.1 and prior. E

2024-10-08 CVE-2024-21219

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and 9.0.1 and prior. E

2024-10-08 CVE-2024-21203

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and

2024-10-08 CVE-2024-21237

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Health Monitor). Supported versions that are affected are 8.0.39 and prior and 8.4.0. Difficult to exp

2024-10-08 CVE-2024-21212

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and 9.0

2024-10-08 CVE-2024-21197

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and 9.0.1 and pr

2024-10-08 CVE-2024-21201

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and 9.0.1 and pr

2024-10-08 CVE-2024-21230

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and 9.0.1 and pr

2024-10-08 CVE-2024-21241

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and 9.0.1 and prior. Ea

2024-10-08 CVE-2024-21193

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.39 and prior 8.4.1 and prior and 9.0.1 a

2024-10-08 CVE-2024-21238

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are 8.0.39 and prior 8.4.2 and prior and 9.0.1 and pri

2024-10-08 CVE-2024-21196

Waitress has a denial of service leading to high CPU usage/resource exhaustion

2024-10-08 CVE-2024-49769