Security Warnings — Week: 2024-W37

express vulnerable to XSS via response.redirect()

2024-09-10 CVE-2024-43796

mediumMicrosoft MSRC 2024-W37

firmware: qcom: scm: Mark get_wq_ctx() as atomic call

2024-09-10 CVE-2024-46692

mediumMicrosoft MSRC 2024-W37

fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE

2024-09-10 CVE-2024-45025

mediumMicrosoft MSRC 2024-W37

fou: Fix null-ptr-deref in GRO.

2024-09-10 CVE-2024-46763

mediumMicrosoft MSRC 2024-W37

fs/netfs/fscache_cookie: add missing "n_accesses" check

2024-09-10 CVE-2024-45000

mediumMicrosoft MSRC 2024-W37

fuse: Initialize beyond-EOF page contents before setting uptodate

2024-09-10 CVE-2024-44947

mediumMicrosoft MSRC 2024-W37

gtp: fix a potential NULL pointer dereference

2024-09-10 CVE-2024-46677

mediumMicrosoft MSRC 2024-W37

gtp: pull network headers in gtp_dev_xmit()

2024-09-10 CVE-2024-44999

highMicrosoft MSRC 2024-W37

HAProxy 2.9.x before 2.9.10 3.0.x before 3.0.4 and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of co

2024-09-10 CVE-2024-45506

highMicrosoft MSRC 2024-W37

HID: amd_sfh: free driver_data after destroying hid device

2024-09-10 CVE-2024-46746

highMicrosoft MSRC 2024-W37

HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup

2024-09-10 CVE-2024-46747

highMicrosoft MSRC 2024-W37

hwmon: (adc128d818) Fix underflows seen when writing limit attributes

2024-09-10 CVE-2024-46759

highMicrosoft MSRC 2024-W37

i2c: tegra: Do not mark ACPI devices as irq safe

2024-09-10 CVE-2024-45029

mediumMicrosoft MSRC 2024-W37

ice: Add netif_device_attach/detach into PF reset flow

2024-09-10 CVE-2024-46770

mediumMicrosoft MSRC 2024-W37

igb: cope with large MAX_SKB_FRAGS

2024-09-10 CVE-2024-45030

mediumMicrosoft MSRC 2024-W37

Integer overflow in PeCoffLoaderRelocateImage

2024-09-10 CVE-2024-38796

mediumMicrosoft MSRC 2024-W37

ipv6: fix possible UAF in ip6_finish_output2()

2024-09-10 CVE-2024-44986

highMicrosoft MSRC 2024-W37

ipv6: prevent possible UAF in ip6_xmit()

2024-09-10 CVE-2024-44985

highMicrosoft MSRC 2024-W37

ipv6: prevent UAF in ip6_send_skb()

2024-09-10 CVE-2024-44987

highMicrosoft MSRC 2024-W37

KVM: arm64: Make ICC_SGI_EL1 undef in the absence of a vGICv3

2024-09-10 CVE-2024-46707

mediumMicrosoft MSRC 2024-W37

KVM: s390: fix validity interception issue when gisa is switched off

2024-09-10 CVE-2024-45005

mediumMicrosoft MSRC 2024-W37

Libopensc: heap buffer overflow in openpgp driver when generating key

2024-09-10 CVE-2024-8443

lowMicrosoft MSRC 2024-W37

media: aspeed: Fix memory overwrite if timing is 1600x900

2024-09-10 CVE-2023-52916

highMicrosoft MSRC 2024-W37

memcg_write_event_control(): fix a user-triggerable oops

2024-09-10 CVE-2024-45021

mediumMicrosoft MSRC 2024-W37

Microsoft Publisher Protection Mechanism Failure Vulnerability

2024-09-10 CVE-2024-38226

highMicrosoft CVE 2024-W37

Microsoft Windows Installer Improper Privilege Management Vulnerability

2024-09-10 CVE-2024-38014

highMicrosoft CVE 2024-W37

Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability

2024-09-10 CVE-2024-38217

highMicrosoft CVE 2024-W37

MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed

2024-09-10 CVE-2024-46832

mediumMicrosoft MSRC 2024-W37

misc: fastrpc: Fix double free of 'buf' in error path

2024-09-10 CVE-2024-46741

highMicrosoft MSRC 2024-W37

mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0

2024-09-10 CVE-2024-45022

mediumMicrosoft MSRC 2024-W37

mmc: mmc_test: Fix NULL dereference on allocation failure

2024-09-10 CVE-2024-45028

mediumMicrosoft MSRC 2024-W37

mptcp: pm: avoid possible UaF when selecting endp

2024-09-10 CVE-2024-44974

highMicrosoft MSRC 2024-W37

mptcp: pm: fix ID 0 endp usage after multiple re-creations

2024-09-10 CVE-2024-46711

mediumMicrosoft MSRC 2024-W37

mptcp: pm: only decrement add_addr_accepted for MPJ req

2024-09-10 CVE-2024-45009

mediumMicrosoft MSRC 2024-W37

mptcp: pm: only mark 'subflow' endp as available

2024-09-10 CVE-2024-45010

mediumMicrosoft MSRC 2024-W37

net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()

2024-09-10 CVE-2024-44971

mediumMicrosoft MSRC 2024-W37

net: dsa: mv88e6xxx: Fix out-of-bound access

2024-09-10 CVE-2024-44988

mediumMicrosoft MSRC 2024-W37

net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()

2024-09-10 CVE-2024-44997

highMicrosoft MSRC 2024-W37

net: hns3: fix a deadlock problem when config TC during resetting

2024-09-10 CVE-2024-44995

mediumMicrosoft MSRC 2024-W37

net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup

2024-09-10 CVE-2024-46784

mediumMicrosoft MSRC 2024-W37

net: mana: Fix RX buf alloc_size alignment and atomic op panic

2024-09-10 CVE-2024-45001

mediumMicrosoft MSRC 2024-W37

net/mlx5e: Take state lock during tx timeout reporter

2024-09-10 CVE-2024-45019

mediumMicrosoft MSRC 2024-W37

netem: fix return value if duplicate enqueue fails

2024-09-10 CVE-2024-45016

mediumMicrosoft MSRC 2024-W37

netfilter: flowtable: initialise extack before use

2024-09-10 CVE-2024-45018

mediumMicrosoft MSRC 2024-W37

netfilter: flowtable: validate vlan header

2024-09-10 CVE-2024-44983

highMicrosoft MSRC 2024-W37

netfilter: nft_socket: fix sk refcount leaks

2024-09-10 CVE-2024-46855

mediumMicrosoft MSRC 2024-W37

nfc: pn533: Add poll mod list filling check

2024-09-10 CVE-2024-46676

mediumMicrosoft MSRC 2024-W37

nilfs2: fix missing cleanup on rollforward recovery error

2024-09-10 CVE-2024-46781

mediumMicrosoft MSRC 2024-W37

nouveau/firmware: use dma non-coherent allocator

2024-09-10 CVE-2024-45012

mediumMicrosoft MSRC 2024-W37

NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host

2024-09-10 CVE-2024-0133

lowMicrosoft MSRC 2024-W37

nvmet-tcp: fix kernel crash if commands allocation fails

2024-09-10 CVE-2024-46737

mediumMicrosoft MSRC 2024-W37

of/irq: Prevent device address out-of-bounds read in interrupt map walk

2024-09-10 CVE-2024-46743

highMicrosoft MSRC 2024-W37

parisc: fix a possible DMA corruption

2024-09-10 CVE-2024-44949

highMicrosoft MSRC 2024-W37

path-to-regexp outputs backtracking regular expressions

2024-09-10 CVE-2024-45296

highMicrosoft MSRC 2024-W37

PCI: Add missing bridge lock to pci_bus_lock()

2024-09-10 CVE-2024-46750

mediumMicrosoft MSRC 2024-W37

pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv

2024-09-10 CVE-2024-46761

mediumMicrosoft MSRC 2024-W37

Pcp: pmpost symlink attack allows escalating pcp to root user

2024-09-10 CVE-2024-45770

mediumMicrosoft MSRC 2024-W37

pinctrl: single: fix potential NULL dereference in pcs_get_function()

2024-09-10 CVE-2024-46685

mediumMicrosoft MSRC 2024-W37

Possible denial of service in X.509 name checks

2024-09-10 CVE-2024-6119

highMicrosoft MSRC 2024-W37

Qemu-kvm: usb: assertion failure in usb_ep_get()

2024-09-10 CVE-2024-8354

mediumMicrosoft MSRC 2024-W37