In the Linux kernel, the following vulnerability has been resolved:  tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().  tcp_v6_do_rcv() no longer calls skb_clone_and_charge_r() for TCP_LISTEN since commit 073d89808c06 ("net: fix data-races around sk->sk_forward_alloc").  However, there is still a small race window between tcp_v6_rcv() and tcp_v6_do_rcv(), where concurrent close() changes TCP_LISTEN to TCP_CLOSE, causing skb_clone_and_charge_r() to be called locklessly and resulting in the splat below. [0]  Let's avoid calling skb_clone_and_charge_r() for TCP_CLOSE as well.  This is fine for non-listeners because tcp_rcv_state_process() drops skb for TCP_CLOSE and opt_skb was freed immediately anyway.  [0]: sk->sk_forward_alloc WARNING: net/ipv4/af_inet.c:162 at inet_sock_destruct+0x64d/0x810 net/ipv4/af_inet.c:162, CPU#1: ksoftirqd/1/28 Modules linked in: CPU: 1 UID: 0 PID: 28 Comm: ksoftirqd/1 Not tainted 7.2.0 #17 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 RIP: 0010:inet_sock_destruct+0x64d/0x810 net/ipv4/af_inet.c:162 Code: 3d 49 ff e9 06 fd ff ff e8 d0 5b 83 f8 90 0f 0b 90 e9 35 fe ff ff e8 c2 5b 83 f8 90 0f 0b 90 e9 c5 fe ff ff e8 b4 5b 83 f8 90 <0f> 0b 90 e9 04 ff ff ff e8 a6 5b 83 f8 90 0f 0b 90 e9 65 fe ff ff RSP: 0018:ffffc90000677bb8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8880117bde80 RCX: ffffffff8957eb41 RDX: ffff88801dad5d00 RSI: ffffffff8957ec3c RDI: 0000000000000005 RBP: 00000000fffff000 R08: ffffffff8957eb41 R09: 00000000fffff000 R10: 0000000000000005 R11: 0000000000000000 R12: dffffc0000000000 R13: ffff8880117bdf10 R14: ffffffff81c08eb7 R15: 0000000000000003 FS:  0000000000000000(0000) GS:ffff8880d7ae5000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f93a1021138 CR3: 00000000207a9000 CR4: 0000000000350ef0 Call Trace:  <TASK>  __sk_destruct+0x82/0xae0 net/core/sock.c:2356  rcu_do_batch kernel/rcu/tree.c:2645 [inline]  rcu_core+0x59c/0x1100 kernel/rcu/tree.c:2897  handle_softirqs+0x1e4/0x9b0 kernel/softirq.c:622  run_ksoftirqd kernel/softirq.c:1076 [inline]  run_ksoftirqd+0x38/0x60 kernel/softirq.c:1068  smpboot_thread_fn+0x458/0xc80 kernel/smpboot.c:160  kthread+0x396/0x4a0 kernel/kthread.c:436  ret_from_fork+0x8e0/0xe40 arch/x86/kernel/process.c:158  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  </TASK>

In the Linux kernel, the following vulnerability has been resolved:  can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents  The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMD_HEADER_LEN can still be dispatched, and the wait path copies a matching command into a fixed caller-owned struct kvaser_cmd using the device-provided length.  Reject nonzero commands that do not contain the fixed header or that extend beyond the current USB buffer item. In the wait path, also reject a matching command that exceeds the destination before copying it.

The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet.

ip-up in ppp-udeb 2.4.4rel on Debian GNU/Linux allows local users to overwrite arbitrary files via a symlink attack on the /tmp/resolv.conf.tmp temporary file.

In the Linux kernel, the following vulnerability has been resolved:  of: overlay: Call of_changeset_init() early  When of_overlay_fdt_apply() fails, the changeset may be partially applied, and the caller is still expected to call of_overlay_remove() to clean up this partial state.  However, of_overlay_apply() calls of_resolve_phandles() before init_overlay_changeset().  Hence if the overlay fails to apply due to an unresolved symbol, the overlay_changeset.cset.entries list is still uninitialized, and cleanup will crash with a NULL-pointer dereference in overlay_removal_is_ok().  Fix this by moving the call to of_changeset_init() from init_overlay_changeset() to of_overlay_fdt_apply(), where all other early initialization is done.

Buffer overflow in ISC DHCP 4.2.x before 4.2.4-P1, when DHCPv6 mode is enabled, allows remote attackers to cause a denial of service (segmentation fault and daemon exit) via a crafted client identifier parameter.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

The sws_init_context function in libswscale/utils.c in FFmpeg before 2.7.2 does not initialize certain pixbuf data structures, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted video data.

Integer overflow in the CSoundFile::ReadMed function (src/load_med.cpp) in libmodplug before 0.8.6, as used in gstreamer-plugins, TTPlayer, and other products, allows context-dependent attackers to execute arbitrary code via a MED file with a crafted (1) song comment or (2) song name, which triggers a heap-based buffer overflow, as exploited in the wild in August 2008.

In the Linux kernel, the following vulnerability has been resolved:  ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()  snd_usbmidi_novation_output() lays out a two-byte header at transfer_buffer[0..1] and passes &transfer_buffer[2] together with a length of ep->max_transfer - 2 to snd_rawmidi_transmit():  	count = snd_rawmidi_transmit(ep->ports[0].substream, 				     &transfer_buffer[2], 				     ep->max_transfer - 2);  ep->max_transfer comes from the output endpoint's wMaxPacketSize via usb_maxpacket(). A malformed or malicious device can advertise a bulk OUT endpoint with a wMaxPacketSize of 1 - the USB core only clamps this value downwards - so ep->max_transfer becomes 1 and the count argument becomes -1.  snd_rawmidi_transmit() passes the negative count on to __snd_rawmidi_transmit_peek(), where "if (count1 > count) count1 = count" leaves count1 negative; get_aligned_size() keeps it negative for a byte-stream substream, so the following memcpy(buffer, ..., count1) runs with a (size_t)-1 length and writes far past the transfer buffer, which was allocated with usb_alloc_coherent(ep->max_transfer).  This is the same class of bug that was fixed for snd_usbmidi_akai_output() in commit 0970274613fb ("ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()"); the novation output routine was left unguarded. Bail out when the endpoint cannot hold the two-byte header plus at least one payload byte.

Multiple integer overflows in X.Org Xserver before 1.4.1 allow context-dependent attackers to execute arbitrary code via (1) a GetVisualInfo request containing a 32-bit value that is improperly used to calculate an amount of memory for allocation by the EVI extension, or (2) a request containing values related to pixmap size that are improperly used in management of shared memory by the MIT-SHM extension.

arch/arm/kvm/arm.c in the Linux kernel before 3.10 on the ARM platform, when KVM is used, allows host OS users to cause a denial of service (NULL pointer dereference, OOPS, and host OS crash) or possibly have unspecified other impact by omitting vCPU initialization before a KVM_GET_REG_LIST ioctl call.

In the Linux kernel, the following vulnerability has been resolved:  nfsd: validate sockaddr length per family in listener_set  nfsd_sock_nl_policy declares NFSD_A_SOCK_ADDR as a bare NLA_BINARY attribute with no minimum length. A CAP_NET_ADMIN caller can send a 16-byte NFSD_A_SOCK_ADDR with sa_family=AF_INET6, causing a 12-byte OOB read across three consumers (rpc_cmp_addr_port, svc_find_listener, kernel_bind).  nfsd_nl_listener_set_doit() also parsed and validated each listener entry inline in two separate loops, interleaved with mutating the running listener configuration. The validation was duplicated, used an open-coded "nla_len < sizeof(struct sockaddr)" check that was too short for AF_INET6, and handled a malformed entry inconsistently depending on which loop noticed it.  Add an nfsd_nl_validate_listeners() helper that walks the entire list once and confirms each entry parses, carries both an address and a transport name, and is long enough for its address family (sizeof(struct sockaddr_in) for AF_INET, sizeof(struct sockaddr_in6) for AF_INET6, -EAFNOSUPPORT otherwise). Call it before taking nfsd_mutex or creating the serv, so a malformed request fails cleanly with no side effects.  Since every entry is known valid by the time the two existing loops run, drop the redundant presence and per-family length checks from both, leaving only the nla_parse_nested() call needed to extract the data.

In the Linux kernel, the following vulnerability has been resolved:  xsk: clear metadata pointer when no timestamp is requested  User space can change metadata flags after request processing. Rereading them during completion can therefore make the kernel write a timestamp that was not requested when the packet was submitted.  Clear the metadata pointer during request processing unless timestamp completion is requested. Completion handling can then use the pointer itself instead of rereading the flags.  On the mlx5 multi-packet WQE path metadata is evaluated per batch: xsk_tx_metadata_request() runs only for the descriptor that starts a session, just like the checksum offload that is applied once through the shared WQE. Only that descriptor's pointer is reset, so completion handling can record a timestamp for the other descriptors of the session regardless of their own XDP_TXMD_FLAGS_TIMESTAMP bit. The write stays inside the metadata area; the single-WQE, other zero-copy, and generic paths reset the pointer per descriptor and are unaffected.

Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under certain unspecified circumstances, which might allow remote attackers to bypass restrictions by causing a persisted string to be associated with the wrong URL.

In the Linux kernel, the following vulnerability has been resolved:  dpaa2-switch: put MAC endpoint device on disconnect  fsl_mc_get_endpoint() returns the MAC endpoint device with a reference taken through device_find_child(). The switch port connect path stores that device in mac->mc_dev and keeps it for the lifetime of the connected MAC object.  However, the disconnect path only closes the MAC and frees the dpaa2_mac object. It does not drop the endpoint device reference stored in mac->mc_dev, so every successful connect leaks that device reference when the MAC is later disconnected.  Drop the endpoint device reference before freeing the dpaa2_mac object.

In the Linux kernel, the following vulnerability has been resolved:  io_uring: fix filename leak in __io_openat_prep()   __io_openat_prep() allocates a struct filename using getname(). However, for the condition of the file being installed in the fixed file table as well as having O_CLOEXEC flag set, the function returns early. At that point, the request doesn't have REQ_F_NEED_CLEANUP flag set. Due to this, the memory for the newly allocated struct filename is not cleaned up, causing a memory leak.  Fix this by setting the REQ_F_NEED_CLEANUP for the request just after the successful getname() call, so that when the request is torn down, the filename will be cleaned up, along with other resources needing cleanup.

linux-2.6 user-mode-linux - several vulnerabilities

The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.

Cross-site scripting (XSS) vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-site request forgery (CSRF) attack to create a root account, via a crafted URL, related to js/ajax.js.

contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 allows local users to overwrite arbitrary files via a symlink attack on a pdf#####.tmp temporary file.

Cross-site scripting (XSS) vulnerability in views_view.php in Ganglia Web 3.5.7 allows remote attackers to inject arbitrary web script or HTML via the view_name parameter.

In the Linux kernel, the following vulnerability has been resolved:  bpf: Add preempt_count_{sub,add} into btf id deny list  The recursion check in __bpf_prog_enter* and __bpf_prog_exit* leave preempt_count_{sub,add} unprotected. When attaching trampoline to them we get panic as follows,  [  867.843050] BUG: TASK stack guard page was hit at 0000000009d325cf (stack is 0000000046a46a15..00000000537e7b28) [  867.843064] stack guard page: 0000 [#1] PREEMPT SMP NOPTI [  867.843067] CPU: 8 PID: 11009 Comm: trace Kdump: loaded Not tainted 6.2.0+ #4 [  867.843100] Call Trace: [  867.843101]  <TASK> [  867.843104]  asm_exc_int3+0x3a/0x40 [  867.843108] RIP: 0010:preempt_count_sub+0x1/0xa0 [  867.843135]  __bpf_prog_enter_recur+0x17/0x90 [  867.843148]  bpf_trampoline_6442468108_0+0x2e/0x1000 [  867.843154]  ? preempt_count_sub+0x1/0xa0 [  867.843157]  preempt_count_sub+0x5/0xa0 [  867.843159]  ? migrate_enable+0xac/0xf0 [  867.843164]  __bpf_prog_exit_recur+0x2d/0x40 [  867.843168]  bpf_trampoline_6442468108_0+0x55/0x1000 ... [  867.843788]  preempt_count_sub+0x5/0xa0 [  867.843793]  ? migrate_enable+0xac/0xf0 [  867.843829]  __bpf_prog_exit_recur+0x2d/0x40 [  867.843837] BUG: IRQ stack guard page was hit at 0000000099bd8228 (stack is 00000000b23e2bc4..000000006d95af35) [  867.843841] BUG: IRQ stack guard page was hit at 000000005ae07924 (stack is 00000000ffd69623..0000000014eb594c) [  867.843843] BUG: IRQ stack guard page was hit at 00000000028320f0 (stack is 00000000034b6438..0000000078d1bcec) [  867.843842]  bpf_trampoline_6442468108_0+0x55/0x1000 ...  That is because in __bpf_prog_exit_recur, the preempt_count_{sub,add} are called after prog->active is decreased.  Fixing this by adding these two functions into btf ids deny list.

In the Linux kernel, the following vulnerability has been resolved:  perf: RISC-V: store available counter mask as bitmap  The available-counter mask was a single unsigned long, but iteration uses RISCV_MAX_COUNTERS, which is 64. On RV32 that reads past the object. Filling with an unsigned-long bit at index 32 and above is also wrong.  Use DECLARE_BITMAP and set_bit/bitmap helpers. Walk each bitmap word into CFG_MATCH when checking events, when allocating an index, and when stopping all counters. Set the counter base to i times BITS_PER_LONG. Share the CFG_MATCH ecall through a small helper so the 32-bit argument split is not duplicated. On qemu-system-riscv32 the probe bitmap has bits above XLEN set, so the first word alone is not enough.  [pjw@kernel.org: updated to apply; fixed checkpatch.pl issues]

Integer overflow in X.org libxcb 1.9 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the read_packet function.

In the Linux kernel, the following vulnerability has been resolved:  net: bridge: vlan: fix bugs caused by switchdev deletion errors  Allowing switchdev to prevent vlan deletion and error out in __vlan_del could cause multiple different issues - inconsistent state, memory leaks when flushing, NULL pointer dereference on bridge error when flushing. It doesn't make sense to allow it to stop __vlan_del, so log the error and continue with software vlan deletion. This is also consistent with 8021q behaviour.

ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-5031.

In the Linux kernel, the following vulnerability has been resolved:  memstick: ms_block: destroy io_queue workqueue on removal  msb_init_disk() creates the per-card ordered workqueue msb->io_queue with alloc_ordered_workqueue(). It is torn down with destroy_workqueue() only on the init error path; msb_remove() never destroys it. msb_stop() merely flushes the queue, and neither msb_data_clear() nor put_disk() free it. As a result every card insert/remove cycle leaks the workqueue and its kworker, exhausting kernel memory over repeated cycles.  Destroy the workqueue in msb_remove() after the disk has been removed and the queue drained.

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.

Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to cause a denial of service (CPU consumption) via a string without an address.

Stack consumption vulnerability in u_bound.c in Xfig 3.2.5b and earlier allows remote attackers to cause a denial of service (application crash) via a long string in a malformed .fig file that uses the 1.3 file format, possibly related to the readfp_fig function in f_read.c.

In the Linux kernel, the following vulnerability has been resolved:  dmaengine: idxd: fix double free of wq, engine, and group structs  The release callbacks for wq, engine, and group devices (idxd_conf_wq_release, idxd_conf_engine_release, idxd_conf_group_release) each call kfree() on the enclosing struct. The setup error paths and cleanup functions also call kfree() explicitly after put_device(), producing a double free whenever put_device() drops the reference count to zero and fires the release.  In the setup functions, device_initialize() is called before device_add(), so the reference count is exactly 1 at the error sites. put_device() unconditionally fires the release, which frees the struct; the subsequent explicit kfree() then operates on freed memory.  For idxd_setup_wqs(), the wq release callback also owns opcap_bmap and wqcfg. The error unwind additionally freed those fields explicitly before calling put_device(), causing further double frees on both.  Remove the redundant explicit kfree() calls from all setup error paths and cleanup functions for wq, engine, and group structs, delegating sole ownership of those allocations to the release callbacks.

Cross-site scripting (XSS) vulnerability in w3m 0.3.2 does not escape an HTML tag in a frame, which allows remote attackers to insert arbitrary web script or HTML and access files or cookies.

In the Linux kernel, the following vulnerability has been resolved:  media: iris: Add sanity check for stop streaming  Add sanity check in iris_vb2_stop_streaming. If inst->state is already IRIS_INST_ERROR, we should skip the stream_off operation because it would still send packets to the firmware.  In iris_kill_session, inst->state is set to IRIS_INST_ERROR and session_close is executed, which will kfree(inst_hfi_gen2->packet). If stop_streaming is called afterward, it will cause a crash.  [bod: remove qcom from patch title]

The csnStreamDissector function in epan/dissectors/packet-csn1.c in the CSN.1 dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle a large number of padding bits, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.

program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email.

The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers an uninitialized pointer dereference.

Heap-based buffer overflow in the rmt_read__ function in lib/rtapelib.c in the rmt client functionality in GNU tar before 1.23 and GNU cpio before 2.11 allows remote rmt servers to cause a denial of service (memory corruption) or possibly execute arbitrary code by sending more data than was requested, related to archive filenames that contain a : (colon) character.

In the Linux kernel, the following vulnerability has been resolved:  ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state()  Return value of a function acpi_evaluate_dsm() is dereferenced  without checking for NULL, but it is usually checked for this function.  acpi_evaluate_dsm() may return NULL, when acpi_evaluate_object() returns acpi_status other than ACPI_SUCCESS, so add a check to prevent the crach.  Found by Linux Verification Center (linuxtesting.org) with SVACE.

fetchmail 6.3.0 and other versions before 6.3.2 allows remote attackers to cause a denial of service (crash) via crafted e-mail messages that cause a free of an invalid pointer when fetchmail bounces the message to the originator or local postmaster.

In the Linux kernel, the following vulnerability has been resolved:  media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()  'read' is freed when it is known to be NULL, but not when a read error occurs.  Revert the logic to avoid a small leak, should a m920x_read() call fail.

Buffer overflow in the run_last_args function in client/fwknop.c in fwknop before 2.0.3, when processing --last, might allow local users to cause a denial of service (client crash) and possibly execute arbitrary code via many .fwknop.run arguments.

In the Linux kernel, the following vulnerability has been resolved:  usb: dwc3: run gadget disconnect from sleepable suspend context  dwc3_gadget_suspend() takes dwc->lock with IRQs disabled and then calls dwc3_disconnect_gadget().  For async callbacks that helper only uses plain spin_unlock()/spin_lock(), so the gadget ->disconnect() callback still runs with IRQs disabled and any sleepable callback trips Lockdep.  This issue was found by our static analysis tool and then manually reviewed against the current tree.  The grounded PoC kept the dwc3_gadget_suspend() -> dwc3_disconnect_gadget() -> gadget_driver->disconnect() chain, and Lockdep reported:    BUG: sleeping function called from invalid context   gadget_disconnect+0x21/0x39 [vuln_msv]   dwc3_gadget_suspend.constprop.0+0x2b/0x42 [vuln_msv]  Keep the disconnect callback selection in one common helper, but add a sleepable suspend-side wrapper which snapshots the callback under dwc->lock and then runs it after spin_unlock_irqrestore().  The regular event path still uses the existing spin_unlock()/spin_lock() window.

The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.

In the Linux kernel, the following vulnerability has been resolved:  Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()  When chunking writes into SMBus blocks in rmi_smb_write_block(), the loop calculates block_len using the original total length (len) instead of the remaining length (cur_len).  If len is greater than 32 bytes (SMB_MAX_COUNT), block_len remains 32 for every iteration, even on the final partial chunk where fewer than 32 bytes remain. This causes smb_block_write() to read 32 bytes from the advanced data buffer pointer, reading past the end of the input buffer.  Fix this by calculating block_len using cur_len and advancing the buffer and address pointers by block_len.

Heap-based buffer overflow in aiff_read_header in libsndfile 1.0.15 through 1.0.19, as used in Winamp 5.552 and possibly other media programs, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an AIFF file with an invalid header value.

Stack-based buffer overflow in udisks before 1.0.5 and 2.x before 2.1.3 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long mount point.

OpenVPN 2.x before 2.0.4, when running in TCP mode, allows remote attackers to cause a denial of service (segmentation fault) by forcing the accept function call to return an error status, which leads to a null dereference in an exception handler.

The dissect_atn_cpdlc_heur function in asn1/atn-cpdlc/packet-atn-cpdlc-template.c in the ATN-CPDLC dissector in Wireshark 1.12.x before 1.12.4 does not properly follow the TRY/ENDTRY code requirements, which allows remote attackers to cause a denial of service (stack memory corruption and application crash) via a crafted packet.

rx/rx.c in OpenAFS before 1.6.15 and 1.7.x before 1.7.33 does not properly initialize the padding of a data structure when constructing an Rx acknowledgement (ACK) packet, which allows remote attackers to obtain sensitive information by (1) conducting a replay attack or (2) sniffing the network.

The xfs_da3_fixhashpath function in fs/xfs/xfs_da_btree.c in the xfs implementation in the Linux kernel before 3.14.2 does not properly compare btree hash values, which allows local users to cause a denial of service (filesystem corruption, and OOPS or panic) via operations on directories that have hash collisions, as demonstrated by rmdir operations.

In the Linux kernel, the following vulnerability has been resolved:  xfrm: ah6: validate routing header segments_left  AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than the number of addresses described by the routing header's hdrlen field.  That assumption does not hold for raw IPv6 HDRINCL packets. A packet with hdrlen equal to 2 describes one address, but can carry an arbitrary segments_left value. With segments_left equal to 255, the function moves its address pointer 4,064 bytes backwards and passes a 4,064-byte length to memmove(), resulting in an out-of-bounds access.  Validate the invariant locally before modifying the routing header or performing any address-pointer arithmetic, and propagate malformed-header errors to the existing AH6 input and output error paths.

CVE ID↕	Published↕	CVSS↓
DEBIAN-CVE-2026-98300	Oct 6, 2026	N/A
DEBIAN-CVE-2026-74458	Aug 15, 2026	N/A
DLA-2111-1	Feb 20, 2020	N/A
DEBIAN-CVE-2011-2749	Aug 15, 2011	N/A
DSA-4591-1	Dec 20, 2019	N/A
DLA-1589-1	Nov 22, 2018	N/A
DEBIAN-CVE-2026-61402	Aug 30, 2026	N/A
DLA-915-1	Apr 25, 2017	N/A
DSA-5611-1	Jan 30, 2024	N/A
DEBIAN-CVE-2008-5367	Dec 8, 2008	N/A
DEBIAN-CVE-2023-53856	Dec 9, 2025	N/A
DLA-2720-1	Jul 26, 2021	N/A
DEBIAN-CVE-2012-3570	Jul 25, 2012	N/A
CVE-2024-35788	May 17, 2024	N/A
DSA-4859-1	Feb 20, 2021	N/A
DEBIAN-CVE-2015-6824	Sep 6, 2015	N/A
DEBIAN-CVE-2009-1438	Apr 27, 2009	N/A
DEBIAN-CVE-2026-80829	Sep 4, 2026	N/A
DEBIAN-CVE-2007-6429	Jan 18, 2008	N/A
DEBIAN-CVE-2013-5634	Sep 25, 2013	N/A
DEBIAN-CVE-2026-89700	Sep 11, 2026	N/A
DEBIAN-CVE-2026-74709	Aug 22, 2026	N/A
DLA-736-1	Dec 7, 2016	N/A
DEBIAN-CVE-2006-2775	Jun 2, 2006	N/A
DEBIAN-CVE-2026-68333	Aug 10, 2026	N/A
DEBIAN-CVE-2025-68814	Jan 13, 2026	N/A
DLA-2387-2	Sep 29, 2020	N/A
DSA-1809-1	Jun 1, 2009	N/A
DLA-825-1	Feb 17, 2017	N/A
DEBIAN-CVE-2015-1819	Aug 14, 2015	N/A
DEBIAN-CVE-2014-6300	Nov 8, 2014	N/A
DEBIAN-CVE-2009-5044	Jun 24, 2011	N/A
DEBIAN-CVE-2013-1770	Apr 2, 2014	N/A
DSA-2904-1	Apr 15, 2014	N/A
DEBIAN-CVE-2023-54086	Dec 24, 2025	N/A
DSA-2705-1	Jun 10, 2013	N/A
DEBIAN-CVE-2026-97587	Sep 25, 2026	N/A
DEBIAN-CVE-2013-2064	Jun 15, 2013	N/A
DEBIAN-CVE-2026-98285	Oct 6, 2026	N/A
DEBIAN-CVE-2012-2751	Jul 22, 2012	N/A
DSA-5464-1	Aug 3, 2023	N/A
DEBIAN-CVE-2026-98227	Oct 6, 2026	N/A
DEBIAN-CVE-2014-7818	Nov 8, 2014	N/A
DEBIAN-CVE-2014-1474	Jul 15, 2014	N/A
DLA-2140-1	Mar 11, 2020	N/A
DEBIAN-CVE-2009-4228	Dec 8, 2009	N/A
DEBIAN-CVE-2026-80698	Aug 28, 2026	N/A
DSA-4532-1	Sep 25, 2019	N/A
DEBIAN-CVE-2002-1335	Dec 11, 2002	N/A
DEBIAN-CVE-2025-68812	Jan 13, 2026	N/A
DEBIAN-CVE-2013-1573	Feb 3, 2013	N/A
DSA-4680-1	May 6, 2020	N/A
DSA-1595-1	Jun 11, 2008	N/A
DEBIAN-CVE-2015-1433	Feb 3, 2015	N/A
DEBIAN-CVE-2011-2728	Dec 21, 2012	N/A
DLA-2233-1	Jun 4, 2020	N/A
DSA-5047-2	Jan 29, 2022	N/A
DEBIAN-CVE-2010-0624	Mar 15, 2010	N/A
DSA-4408-1	Mar 17, 2019	N/A
DEBIAN-CVE-2025-40098	Oct 30, 2025	N/A
DEBIAN-CVE-2006-0321	Jan 24, 2006	N/A
DLA-780-1	Jan 12, 2017	N/A
DEBIAN-CVE-2023-54266	Dec 30, 2025	N/A
DEBIAN-CVE-2012-4436	Oct 22, 2012	N/A
DEBIAN-CVE-2026-64454	Jul 25, 2026	N/A
DEBIAN-CVE-2015-2265	Mar 24, 2015	N/A
DEBIAN-CVE-2026-98204	Oct 6, 2026	N/A
DSA-1608-1	Jul 13, 2008	N/A
DEBIAN-CVE-2009-1791	May 26, 2009	N/A
DEBIAN-CVE-2014-0004	Mar 11, 2014	N/A
DSA-4027-1	Nov 9, 2017	N/A
DEBIAN-CVE-2005-3409	Nov 2, 2005	N/A
DSA-4672-1	May 1, 2020	N/A
DEBIAN-CVE-2015-2187	Mar 8, 2015	N/A
DEBIAN-CVE-2015-7762	Nov 6, 2015	N/A
DEBIAN-CVE-2014-7283	Oct 13, 2014	N/A
DEBIAN-CVE-2026-80844	Sep 4, 2026	N/A
DLA-651-1	Oct 11, 2016	N/A
DTSA-148-1	Jul 9, 2008	N/A

Know every vulnerability
before it knows you.

debian CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

debian CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.