Security Warnings — Week: 2025-W03

Aviatrix Controllers OS Command Injection Vulnerability

2025-01-16 CVE-2024-50603

highAviatrix CVE 2025-W03

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as

2025-01-14 CVE-2025-23084

mediumMicrosoft MSRC 2025-W03

ACPI: x86: Add adev NULL check to acpi_quirk_skip_serdev_enumeration()

2025-01-14 CVE-2024-56782

mediumMicrosoft MSRC 2025-W03

af_packet: fix vlan_get_tci() vs MSG_PEEK

2025-01-14 CVE-2024-57902

mediumMicrosoft MSRC 2025-W03

afs: Fix merge preference rule failure condition

2025-01-14 CVE-2025-21672

mediumMicrosoft MSRC 2025-W03

ALSA: seq: oss: Fix races at processing SysEx messages

2025-01-14 CVE-2024-57893

mediumMicrosoft MSRC 2025-W03

An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_file function.

2025-01-14 CVE-2024-55459

mediumMicrosoft MSRC 2025-W03

Apache Tomcat mod_jk Connector: Schwachstelle ermöglicht Umgehung von Sicherheitsmaßnahmen oder Offenlegung von Informationen

2025-01-14 CVE-2023-41081

mediumBSI 2025-W03

arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL

2025-01-14 CVE-2024-57874

mediumMicrosoft MSRC 2025-W03

block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()

2025-01-14 CVE-2025-21631

highMicrosoft MSRC 2025-W03

block: RCU protect disk->conv_zones_bitmap

2025-01-14 CVE-2024-57875

mediumMicrosoft MSRC 2025-W03

bpf: Fix bpf_sk_select_reuseport() memory leak

2025-01-14 CVE-2025-21683

mediumMicrosoft MSRC 2025-W03

bpf: Prevent tailcall infinite loop caused by freplace

2025-01-14 CVE-2024-47794

mediumMicrosoft MSRC 2025-W03

btrfs: add a sanity check for btrfs root in btrfs_search_slot()

2025-01-14 CVE-2024-56774

mediumMicrosoft MSRC 2025-W03

btrfs: avoid NULL pointer dereference if no valid extent tree

2025-01-14 CVE-2025-21658

mediumMicrosoft MSRC 2025-W03

btrfs: don't take dev_replace rwsem on task already holding it

2025-01-14 CVE-2024-48875

mediumMicrosoft MSRC 2025-W03

btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount

2025-01-14 CVE-2024-57896

highMicrosoft MSRC 2025-W03

cgroup/cpuset: remove kernfs active break

2025-01-14 CVE-2025-21634

mediumMicrosoft MSRC 2025-W03

dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset

2025-01-14 CVE-2024-56767

mediumMicrosoft MSRC 2025-W03

DNS-over-HTTPS implementation suffers from multiple issues under heavy query load

2025-01-14 CVE-2024-12705

highMicrosoft MSRC 2025-W03

Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet

2025-01-14 CVE-2024-55916

mediumMicrosoft MSRC 2025-W03

drm: adv7511: Fix use-after-free in adv7533_attach_dsi()

2025-01-14 CVE-2024-57887

highMicrosoft MSRC 2025-W03

drm/amd/display: Add check for granularity in dml ceil/floor helpers

2025-01-14 CVE-2024-57922

mediumMicrosoft MSRC 2025-W03

drm/amd/display: Adding array index check to prevent memory corruption

2025-01-14 CVE-2024-56784

highMicrosoft MSRC 2025-W03

drm/amd/display: Fix handling of plane refcount

2025-01-14 CVE-2024-56775

highMicrosoft MSRC 2025-W03

drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()

2025-01-14 CVE-2024-57798

highMicrosoft MSRC 2025-W03

drm/dp_mst: Fix resetting msg rx state after topology removal

2025-01-14 CVE-2024-57876

highMicrosoft MSRC 2025-W03

drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err

2025-01-14 CVE-2024-57926

highMicrosoft MSRC 2025-W03

drm/modes: Avoid divide by zero harder in drm_mode_vrefresh()

2025-01-14 CVE-2024-56369

mediumMicrosoft MSRC 2025-W03

drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check

2025-01-14 CVE-2024-56777

mediumMicrosoft MSRC 2025-W03

drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check

2025-01-14 CVE-2024-56778

mediumMicrosoft MSRC 2025-W03

eth: bnxt: always recalculate features after XDP clearing, fix null-deref

2025-01-14 CVE-2025-21682

mediumMicrosoft MSRC 2025-W03

Excessive Platform Resource Consumption within a Loop when unmarshalling Compose file having recursive loop

2025-01-14 CVE-2024-10846

mediumMicrosoft MSRC 2025-W03

f2fs: fix to shrink read extent node in batches

2025-01-14 CVE-2024-41935

highMicrosoft MSRC 2025-W03

FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This

2025-01-14 CVE-2025-23016

criticalMicrosoft MSRC 2025-W03

filemap: avoid truncating 64-bit offset to 32 bits

2025-01-14 CVE-2025-21665

mediumMicrosoft MSRC 2025-W03

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

2025-01-14 CVE-2024-55591

criticalFortinet CVE 2025-W03

fs: relax assertions on failure to encode file handles

2025-01-14 CVE-2024-57924

mediumMicrosoft MSRC 2025-W03

GNU Binutils objdump.c disassemble_bytes stack-based overflow

2025-01-14 CVE-2025-0840

mediumMicrosoft MSRC 2025-W03

go-git clients vulnerable to DoS via maliciously crafted Git server replies

2025-01-14 CVE-2025-21614

highMicrosoft MSRC 2025-W03

Google Chrome / Microsoft Edge : Mehrere Schwachstellen ermöglichen Codeausführung

2025-01-14 CVE-2023-5186

highBSI 2025-W03

Google Chrome / Microsoft Edge: Schwachstelle ermöglicht Codeausführung

2025-01-14 CVE-2023-4863

highBSI 2025-W03

gve: guard XSK operations on the existence of queues

2025-01-14 CVE-2024-57933

mediumMicrosoft MSRC 2025-W03

heap-buffer-overflow with visual mode in Vim < 9.1.1003

2025-01-14 CVE-2025-22134

mediumMicrosoft MSRC 2025-W03

hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur

2025-01-14 CVE-2025-21656

mediumMicrosoft MSRC 2025-W03

i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request

2025-01-14 CVE-2024-45828

mediumMicrosoft MSRC 2025-W03

i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock

2025-01-14 CVE-2024-43098

mediumMicrosoft MSRC 2025-W03

iio: adc: rockchip_saradc: fix information leak in triggered buffer

2025-01-14 CVE-2024-57907

highMicrosoft MSRC 2025-W03

iio: adc: ti-ads8688: fix information leak in triggered buffer

2025-01-14 CVE-2024-57906

highMicrosoft MSRC 2025-W03

iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer

2025-01-14 CVE-2024-57911

highMicrosoft MSRC 2025-W03

iio: imu: kmx61: fix information leak in triggered buffer

2025-01-14 CVE-2024-57908

highMicrosoft MSRC 2025-W03

iio: light: vcnl4035: fix information leak in triggered buffer

2025-01-14 CVE-2024-57910

highMicrosoft MSRC 2025-W03

iio: pressure: zpa2326: fix information leak in triggered buffer

2025-01-14 CVE-2024-57912

highMicrosoft MSRC 2025-W03

ila: serialize calls to nf_register_net_hooks()

2025-01-14 CVE-2024-57900

highMicrosoft MSRC 2025-W03

In FRRouting (FRR) all routes are re-validated if the total size of an update received via RTR exceeds the internal socket's buffer size

2025-01-14 CVE-2024-55553

highMicrosoft MSRC 2025-W03

iomap: avoid avoid truncating 64-bit offset to 32 bits

2025-01-14 CVE-2025-21667

mediumMicrosoft MSRC 2025-W03

ipvlan: Fix use-after-free in ipvlan_get_iflink().

2025-01-14 CVE-2025-21652

highMicrosoft MSRC 2025-W03

jffs2: Prevent rtime decompress memory corruption

2025-01-14 CVE-2024-57850

highMicrosoft MSRC 2025-W03

ksmbd: fix a missing return value check bug

2025-01-14 CVE-2024-57925

highMicrosoft MSRC 2025-W03

Many records in the additional section cause CPU exhaustion

2025-01-14 CVE-2024-11187

highMicrosoft MSRC 2025-W03