Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
25,502 results · page 398 of 511
Dec 23, 2022An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2.CVE-2022-47943 · Computers, phones & browsers · Linux · reported by MITREHigh 8.1
An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is an out-of-bounds read and OOPS for SMB2_WRITE, when there is a large length in the zero DataOffset case.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comcdn.kernel.org
Dec 23, 2022An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2.CVE-2022-47942 · Computers, phones & browsers · Linux · reported by MITREHigh 8.8
An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is a heap-based buffer overflow in set_ntacl_dacl, related to use of SMB2_QUERY_INFO_HE after a malformed SMB2_SET_INFO_HE command.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comcdn.kernel.org
Dec 23, 2022An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2.CVE-2022-47941 · Computers, phones & browsers · Linux · reported by MITREHigh 7.5
An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c omits a kfree call in certain smb2_handle_negotiate error conditions, aka a memory leak.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comcdn.kernel.org
Dec 23, 2022An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.18 before 5.18.18.CVE-2022-47940 · Computers, phones & browsers · Linux · reported by MITREHigh 8.1
An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.18 before 5.18.18. fs/ksmbd/smb2pdu.c lacks length validation in the non-padding case in smb2_write.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comcdn.kernel.org
Dec 23, 2022An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2.CVE-2022-47939 · Computers, phones & browsers · Linux · reported by MITRECritical 9.8
An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c has a use-after-free and OOPS for SMB2_TREE_DISCONNECT.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comcdn.kernel.org
Dec 23, 2022An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2.CVE-2022-47938 · Computers, phones & browsers · Linux · reported by MITREMedium 6.5
An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2misc.c has an out-of-bounds read and OOPS for SMB2_TREE_CONNECT.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comcdn.kernel.org
Dec 22, 2022A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device.CVE-2022-4662 · Other software · Siemens · reported by Red HatMedium 5.5
A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A local user could use this flaw to crash the system.
- Product
- SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlore.kernel.orglore.kernel.org
Dec 20, 2022The kernel module has an out-of-bounds read vulnerability.CVE-2022-46320 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
The kernel module has an out-of-bounds read vulnerability. Successful exploitation of this vulnerability may cause memory overwriting.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Dec 18, 2022An issue was discovered in the Linux kernel before 6.0.11.CVE-2022-47521 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_CHANNEL_LIST in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Dec 18, 2022An issue was discovered in the Linux kernel before 6.0.11.CVE-2022-47520 · Other software · Siemens · reported by MITREHigh 7.1
An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet.
- Product
- SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Dec 18, 2022An issue was discovered in the Linux kernel before 6.0.11.CVE-2022-47519 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_OPER_CHANNEL in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Dec 18, 2022An issue was discovered in the Linux kernel before 6.0.11.CVE-2022-47518 · Other software · Siemens · reported by MITREHigh 7.8
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management frames.
- Product
- SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Dec 16, 2022Product: AndroidVersions: Android kernelAndroid ID: A-235292841References: N/ACVE-2022-42529 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
Product: AndroidVersions: Android kernelAndroid ID: A-235292841References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 16, 2022Product: AndroidVersions: Android kernelAndroid ID: A-211081867References: N/ACVE-2022-20602 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
Product: AndroidVersions: Android kernelAndroid ID: A-211081867References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 16, 2022Product: AndroidVersions: Android kernelAndroid ID: A-204541506References: N/ACVE-2022-20601 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
Product: AndroidVersions: Android kernelAndroid ID: A-204541506References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 16, 2022In extract_metadata of dm-android-verity.c, there is a possible way to corrupt kernel memory due to a use after free.CVE-2022-20571 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In extract_metadata of dm-android-verity.c, there is a possible way to corrupt kernel memory due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-234030265References: Upstream kernel
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 16, 2022Product: AndroidVersions: Android kernelAndroid ID: A-230660904References: N/ACVE-2022-20570 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
Product: AndroidVersions: Android kernelAndroid ID: A-230660904References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 16, 2022In (TBD) of (TBD), there is a possible way to corrupt kernel memory due to a use after free.CVE-2022-20568 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In (TBD) of (TBD), there is a possible way to corrupt kernel memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-220738351References: Upstream kernel
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 16, 2022Product: AndroidVersions: Android kernelAndroid ID: A-212623833References: N/ACVE-2022-20560 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
Product: AndroidVersions: Android kernelAndroid ID: A-212623833References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 15, 2022An out-of-bounds read issue existed that led to the disclosure of kernel memory.CVE-2022-32916 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in iOS 16. An app may be able to disclose kernel memory.
- Product
- iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 14, 2022An issue was discovered in the Linux kernel through 5.16-rc6.CVE-2022-3115 · Other software · Siemens · reported by Red HatMedium 5.5
An issue was discovered in the Linux kernel through 5.16-rc6. malidp_crtc_reset in drivers/gpu/drm/arm/malidp_crtc.c lacks check of the return value of kzalloc() and will cause the null pointer dereference.
- Product
- SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgit.kernel.org
Dec 14, 2022An issue was discovered in the Linux kernel through 5.16-rc6.CVE-2022-3114 · Computers, phones & browsers · Linux · reported by Red HatMedium 5.5
An issue was discovered in the Linux kernel through 5.16-rc6. imx_register_uart_clocks in drivers/clk/imx/clk.c lacks check of the return value of kcalloc() and will cause the null pointer dereference.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgit.kernel.org
Dec 14, 2022An issue was discovered in the Linux kernel through 5.16-rc6.CVE-2022-3113 · Computers, phones & browsers · Linux · reported by Red HatMedium 5.5
An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c lacks check of the return value of devm_kzalloc() and will cause the null pointer dereference.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgit.kernel.org
Dec 14, 2022An issue was discovered in the Linux kernel through 5.16-rc6.CVE-2022-3112 · Computers, phones & browsers · Linux · reported by Red HatMedium 5.5
An issue was discovered in the Linux kernel through 5.16-rc6. amvdec_set_canvases in drivers/staging/media/meson/vdec/vdec_helpers.c lacks check of the return value of kzalloc() and will cause the null pointer dereference.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgit.kernel.org
Dec 14, 2022An issue was discovered in the Linux kernel through 5.16-rc6.CVE-2022-3111 · Computers, phones & browsers · Linux · reported by Red HatMedium 5.5
An issue was discovered in the Linux kernel through 5.16-rc6. free_charger_irq() in drivers/power/supply/wm8350_power.c lacks free of WM8350_IRQ_CHG_FAST_RDY, which is registered in wm8350_init_charger().
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgit.kernel.org
Dec 14, 2022An issue was discovered in the Linux kernel through 5.16-rc6.CVE-2022-3110 · Computers, phones & browsers · Linux · reported by Red HatMedium 5.5
An issue was discovered in the Linux kernel through 5.16-rc6. _rtw_init_xmit_priv in drivers/staging/r8188eu/core/rtw_xmit.c lacks check of the return value of rtw_alloc_hwxmits() and will cause the null pointer dereference.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgit.kernel.org
Dec 14, 2022An issue was discovered in the Linux kernel through 5.16-rc6.CVE-2022-3108 · Computers, phones & browsers · Linux · reported by Red HatMedium 5.5
An issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c lacks check of the return value of kmemdup().
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgit.kernel.org
Dec 14, 2022An issue was discovered in the Linux kernel through 5.16-rc6.CVE-2022-3107 · Computers, phones & browsers · Linux · reported by Red HatMedium 5.5
An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kvmalloc_array() and will cause the null pointer dereference.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgit.kernel.org
Dec 14, 2022An issue was discovered in the Linux kernel through 5.16-rc6.CVE-2022-3106 · Computers, phones & browsers · Linux · reported by Red HatMedium 5.5
An issue was discovered in the Linux kernel through 5.16-rc6. ef100_update_stats in drivers/net/ethernet/sfc/ef100_nic.c lacks check of the return value of kmalloc().
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgit.kernel.org
Dec 14, 2022An issue was discovered in the Linux kernel through 5.16-rc6.CVE-2022-3105 · Computers, phones & browsers · Linux · reported by Red HatMedium 5.5
An issue was discovered in the Linux kernel through 5.16-rc6. uapi_finalize in drivers/infiniband/core/uverbs_uapi.c lacks check of kmalloc_array().
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgit.kernel.org
Dec 14, 2022An issue was discovered in the Linux kernel through 5.16-rc6.CVE-2022-3104 · Other software · Siemens · reported by Red HatMedium 5.5
An issue was discovered in the Linux kernel through 5.16-rc6. lkdtm_ARRAY_BOUNDS in drivers/misc/lkdtm/bugs.c lacks check of the return value of kmalloc() and will cause the null pointer dereference.
- Product
- SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgit.kernel.org
Dec 13, 2022DirectX Graphics Kernel Elevation of Privilege VulnerabilityCVE-2022-44710 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
DirectX Graphics Kernel Elevation of Privilege Vulnerability
- Product
- Windows 11 version 22H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 13, 2022Windows Kernel Denial of Service VulnerabilityCVE-2022-44707 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Windows Kernel Denial of Service Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 13, 2022Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege VulnerabilityCVE-2022-44689 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Dec 13, 2022Windows Kernel Elevation of Privilege VulnerabilityCVE-2022-44683 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Kernel Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 13, 2022Possible memory corruption in kernel while performing memory access due to hypervisor not correctly invalidated the processor translation caches in Snapdragon ACVE-2022-25681 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Possible memory corruption in kernel while performing memory access due to hypervisor not correctly invalidated the processor translation caches in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Dec 13, 2022In TBD of TBD, there is a possible way to archive arbitrary code execution in kernel due to a race condition.CVE-2021-39660 · Computers, phones & browsers · Google · reported by security@android.comHigh 7
In TBD of TBD, there is a possible way to archive arbitrary code execution in kernel due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-254742984
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 12, 2022An issue was discovered in the Arm Mali GPU Kernel Driver.CVE-2022-42716 · Computers, phones & browsers · ARM · reported by MITREHigh 8.8
An issue was discovered in the Arm Mali GPU Kernel Driver. There is a use-after-free. A non-privileged user can make improper GPU processing operations to gain access to already freed memory. This affects Valhall r29p0 through r40P0.
- Product
- Valhall GPU Kernel Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdeveloper.arm.com
Dec 8, 2022Kernel subsystem within OpenHarmony-v3.1.4 and prior versions in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGetres.CVE-2022-41802 · Other software · OpenHarmony · reported by scy@openharmony.ioMedium 4
Kernel subsystem within OpenHarmony-v3.1.4 and prior versions in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGetres. 4 bytes padding data from kernel stack are copied to user space incorrectly and leaked.
- Product
- OpenHarmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2022Exposure of Sensitive Information vulnerability in kernel prior to SMR Dec-2022 Release 1 allows attackers to access the kernel address information via log.CVE-2022-39897 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.4
Exposure of Sensitive Information vulnerability in kernel prior to SMR Dec-2022 Release 1 allows attackers to access the kernel address information via log.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Dec 5, 2022A flaw was found in the Linux kernel Traffic Control (TC) subsystem.CVE-2022-4269 · Other software · Siemens · reported by Red HatMedium 5.5
A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of service condition.
- Product
- SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglore.kernel.org
Nov 30, 2022A race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial of service (host OS crash or host OS memorCVE-2022-45869 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
A race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial of service (host OS crash or host OS memory corruption) when nested virtualisation and the TDP MMU are enabled.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Nov 28, 2022A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP).CVE-2022-4129 · Other software · Siemens · reported by Red HatMedium 5.5
A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw to potentially crash the system causing a denial of service.
- Product
- SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Nov 28, 2022A NULL pointer dereference issue was discovered in the Linux kernel in the MPTCP protocol when traversing the subflow list at disconnect time.CVE-2022-4128 · Computers, phones & browsers · Linux · reported by Red HatMedium 5.5
A NULL pointer dereference issue was discovered in the Linux kernel in the MPTCP protocol when traversing the subflow list at disconnect time. A local user could use this flaw to potentially crash the system causing a denial of service.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlore.kernel.org
Nov 28, 2022A NULL pointer dereference issue was discovered in the Linux kernel in io_files_update_with_index_alloc.CVE-2022-4127 · Computers, phones & browsers · Linux · reported by Red HatMedium 5.5
A NULL pointer dereference issue was discovered in the Linux kernel in io_files_update_with_index_alloc. A local user could use this flaw to potentially crash the system causing a denial of service.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlore.kernel.org
Nov 26, 2022An issue was discovered in the Linux kernel through 6.0.10.CVE-2022-45934 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orglists.debian.org
Nov 26, 2022An issue was discovered in the Linux kernel through 6.0.10.CVE-2022-45919 · Computers, phones & browsers · Linux · reported by MITREHigh 7
An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orglore.kernel.org
Nov 24, 2022An issue was discovered in the Linux kernel through 6.0.9.CVE-2022-45888 · Computers, phones & browsers · Linux · reported by MITREMedium 6.4
An issue was discovered in the Linux kernel through 6.0.9. drivers/char/xillybus/xillyusb.c has a race condition and use-after-free during physical removal of a USB device.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orglore.kernel.org
Nov 24, 2022An issue was discovered in the Linux kernel through 6.0.9.CVE-2022-45887 · Computers, phones & browsers · Linux · reported by MITREMedium 4.7
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orglore.kernel.org
Nov 24, 2022An issue was discovered in the Linux kernel through 6.0.9.CVE-2022-45886 · Computers, phones & browsers · Linux · reported by MITREHigh 7
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a .disconnect versus dvb_device_open race condition that leads to a use-after-free.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orglore.kernel.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.