Skip to content

Commit 75ebfba

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 3848adf commit 75ebfba

File tree

64 files changed

+1723
-65
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

64 files changed

+1723
-65
lines changed

‎advisories/unreviewed/2022/05/GHSA-g2jw-fqx3-5mwq/GHSA-g2jw-fqx3-5mwq.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,9 @@
3737
}
3838
],
3939
"database_specific": {
40-
"cwe_ids": [],
40+
"cwe_ids": [
41+
"CWE-377"
42+
],
4143
"severity": "CRITICAL",
4244
"github_reviewed": false,
4345
"github_reviewed_at": null,

‎advisories/unreviewed/2022/05/GHSA-gwwq-gpw7-qfjr/GHSA-gwwq-gpw7-qfjr.json‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-gwwq-gpw7-qfjr",
4-
"modified": "2022-05-17T03:46:13Z",
4+
"modified": "2025-12-04T21:31:01Z",
55
"published": "2022-05-17T03:46:12Z",
66
"aliases": [
77
"CVE-2014-0207"
88
],
99
"details": "The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -93,7 +98,8 @@
9398
],
9499
"database_specific": {
95100
"cwe_ids": [
96-
"CWE-119"
101+
"CWE-119",
102+
"CWE-20"
97103
],
98104
"severity": "MODERATE",
99105
"github_reviewed": false,

‎advisories/unreviewed/2022/05/GHSA-h772-f5rg-qrvv/GHSA-h772-f5rg-qrvv.json‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-h772-f5rg-qrvv",
4-
"modified": "2022-05-17T03:46:07Z",
4+
"modified": "2025-12-04T21:31:01Z",
55
"published": "2022-05-17T03:46:07Z",
66
"aliases": [
77
"CVE-2014-3478"
88
],
99
"details": "Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{

‎advisories/unreviewed/2022/05/GHSA-vm23-73fg-gcq2/GHSA-vm23-73fg-gcq2.json‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-vm23-73fg-gcq2",
4-
"modified": "2022-05-17T03:46:07Z",
4+
"modified": "2025-12-04T21:31:01Z",
55
"published": "2022-05-17T03:46:07Z",
66
"aliases": [
77
"CVE-2014-3480"
88
],
99
"details": "The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{

‎advisories/unreviewed/2022/05/GHSA-xv4r-r9fj-hh6h/GHSA-xv4r-r9fj-hh6h.json‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-xv4r-r9fj-hh6h",
4-
"modified": "2022-05-17T04:50:16Z",
4+
"modified": "2025-12-04T21:31:01Z",
55
"published": "2022-05-17T04:50:16Z",
66
"aliases": [
77
"CVE-2012-1571"
88
],
99
"details": "file before 5.11 and libmagic allow remote attackers to cause a denial of service (crash) via a crafted Composite Document File (CDF) file that triggers (1) an out-of-bounds read or (2) an invalid pointer dereference.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -41,7 +46,8 @@
4146
],
4247
"database_specific": {
4348
"cwe_ids": [
44-
"CWE-119"
49+
"CWE-119",
50+
"CWE-125"
4551
],
4652
"severity": "MODERATE",
4753
"github_reviewed": false,

‎advisories/unreviewed/2025/09/GHSA-3mx8-688w-x5vh/GHSA-3mx8-688w-x5vh.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3mx8-688w-x5vh",
4-
"modified": "2025-09-15T15:31:26Z",
4+
"modified": "2025-12-04T21:31:01Z",
55
"published": "2025-09-15T15:31:25Z",
66
"aliases": [
77
"CVE-2022-50282"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nchardev: fix error handling in cdev_device_add()\n\nWhile doing fault injection test, I got the following report:\n\n------------[ cut here ]------------\nkobject: '(null)' (0000000039956980): is not initialized, yet kobject_put() is being called.\nWARNING: CPU: 3 PID: 6306 at kobject_put+0x23d/0x4e0\nCPU: 3 PID: 6306 Comm: 283 Tainted: G W 6.1.0-rc2-00005-g307c1086d7c9 #1253\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\nRIP: 0010:kobject_put+0x23d/0x4e0\nCall Trace:\n <TASK>\n cdev_device_add+0x15e/0x1b0\n __iio_device_register+0x13b4/0x1af0 [industrialio]\n __devm_iio_device_register+0x22/0x90 [industrialio]\n max517_probe+0x3d8/0x6b4 [max517]\n i2c_device_probe+0xa81/0xc00\n\nWhen device_add() is injected fault and returns error, if dev->devt is not set,\ncdev_add() is not called, cdev_del() is not needed. Fix this by checking dev->devt\nin error path.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -52,8 +57,10 @@
5257
}
5358
],
5459
"database_specific": {
55-
"cwe_ids": [],
56-
"severity": null,
60+
"cwe_ids": [
61+
"CWE-908"
62+
],
63+
"severity": "MODERATE",
5764
"github_reviewed": false,
5865
"github_reviewed_at": null,
5966
"nvd_published_at": "2025-09-15T15:15:39Z"

‎advisories/unreviewed/2025/09/GHSA-45cv-7v28-m46p/GHSA-45cv-7v28-m46p.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-45cv-7v28-m46p",
4-
"modified": "2025-09-15T15:31:26Z",
4+
"modified": "2025-12-04T21:31:01Z",
55
"published": "2025-09-15T15:31:26Z",
66
"aliases": [
77
"CVE-2022-50293"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range\n\nIf we get -ENOMEM while dropping file extent items in a given range, at\nbtrfs_drop_extents(), due to failure to allocate memory when attempting to\nincrement the reference count for an extent or drop the reference count,\nwe handle it with a BUG_ON(). This is excessive, instead we can simply\nabort the transaction and return the error to the caller. In fact most\ncallers of btrfs_drop_extents(), directly or indirectly, already abort\nthe transaction if btrfs_drop_extents() returns any error.\n\nAlso, we already have error paths at btrfs_drop_extents() that may return\n-ENOMEM and in those cases we abort the transaction, like for example\nanything that changes the b+tree may return -ENOMEM due to a failure to\nallocate a new extent buffer when COWing an existing extent buffer, such\nas a call to btrfs_duplicate_item() for example.\n\nSo replace the BUG_ON() calls with proper logic to abort the transaction\nand return the error.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -32,8 +37,10 @@
3237
}
3338
],
3439
"database_specific": {
35-
"cwe_ids": [],
36-
"severity": null,
40+
"cwe_ids": [
41+
"CWE-617"
42+
],
43+
"severity": "MODERATE",
3744
"github_reviewed": false,
3845
"github_reviewed_at": null,
3946
"nvd_published_at": "2025-09-15T15:15:40Z"

‎advisories/unreviewed/2025/09/GHSA-4cq8-42w3-9m79/GHSA-4cq8-42w3-9m79.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-4cq8-42w3-9m79",
4-
"modified": "2025-09-15T15:31:25Z",
4+
"modified": "2025-12-04T21:31:01Z",
55
"published": "2025-09-15T15:31:25Z",
66
"aliases": [
77
"CVE-2022-50281"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: SGI-IP27: Fix platform-device leak in bridge_platform_create()\n\nIn error case in bridge_platform_create after calling\nplatform_device_add()/platform_device_add_data()/\nplatform_device_add_resources(), release the failed\n'pdev' or it will be leak, call platform_device_put()\nto fix this problem.\n\nBesides, 'pdev' is divided into 'pdev_wd' and 'pdev_bd',\nuse platform_device_unregister() to release sgi_w1\nresources when xtalk-bridge registration fails.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -36,8 +41,10 @@
3641
}
3742
],
3843
"database_specific": {
39-
"cwe_ids": [],
40-
"severity": null,
44+
"cwe_ids": [
45+
"CWE-401"
46+
],
47+
"severity": "MODERATE",
4148
"github_reviewed": false,
4249
"github_reviewed_at": null,
4350
"nvd_published_at": "2025-09-15T15:15:39Z"

‎advisories/unreviewed/2025/09/GHSA-cv22-jrqw-mx35/GHSA-cv22-jrqw-mx35.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-cv22-jrqw-mx35",
4-
"modified": "2025-09-15T15:31:25Z",
4+
"modified": "2025-12-04T21:31:01Z",
55
"published": "2025-09-15T15:31:25Z",
66
"aliases": [
77
"CVE-2022-50283"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: core: add missing of_node_get() in dynamic partitions code\n\nThis fixes unbalanced of_node_put():\n[ 1.078910] 6 cmdlinepart partitions found on MTD device gpmi-nand\n[ 1.085116] Creating 6 MTD partitions on \"gpmi-nand\":\n[ 1.090181] 0x000000000000-0x000008000000 : \"nandboot\"\n[ 1.096952] 0x000008000000-0x000009000000 : \"nandfit\"\n[ 1.103547] 0x000009000000-0x00000b000000 : \"nandkernel\"\n[ 1.110317] 0x00000b000000-0x00000c000000 : \"nanddtb\"\n[ 1.115525] ------------[ cut here ]------------\n[ 1.120141] refcount_t: addition on 0; use-after-free.\n[ 1.125328] WARNING: CPU: 0 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0xdc/0x148\n[ 1.133528] Modules linked in:\n[ 1.136589] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc7-next-20220930-04543-g8cf3f7\n[ 1.146342] Hardware name: Freescale i.MX8DXL DDR3L EVK (DT)\n[ 1.151999] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 1.158965] pc : refcount_warn_saturate+0xdc/0x148\n[ 1.163760] lr : refcount_warn_saturate+0xdc/0x148\n[ 1.168556] sp : ffff800009ddb080\n[ 1.171866] x29: ffff800009ddb080 x28: ffff800009ddb35a x27: 0000000000000002\n[ 1.179015] x26: ffff8000098b06ad x25: ffffffffffffffff x24: ffff0a00ffffff05\n[ 1.186165] x23: ffff00001fdf6470 x22: ffff800009ddb367 x21: 0000000000000000\n[ 1.193314] x20: ffff00001fdfebe8 x19: ffff00001fdfec50 x18: ffffffffffffffff\n[ 1.200464] x17: 0000000000000000 x16: 0000000000000118 x15: 0000000000000004\n[ 1.207614] x14: 0000000000000fff x13: ffff800009bca248 x12: 0000000000000003\n[ 1.214764] x11: 00000000ffffefff x10: c0000000ffffefff x9 : 4762cb2ccb52de00\n[ 1.221914] x8 : 4762cb2ccb52de00 x7 : 205d313431303231 x6 : 312e31202020205b\n[ 1.229063] x5 : ffff800009d55c1f x4 : 0000000000000001 x3 : 0000000000000000\n[ 1.236213] x2 : 0000000000000000 x1 : ffff800009954be6 x0 : 000000000000002a\n[ 1.243365] Call trace:\n[ 1.245806] refcount_warn_saturate+0xdc/0x148\n[ 1.250253] kobject_get+0x98/0x9c\n[ 1.253658] of_node_get+0x20/0x34\n[ 1.257072] of_fwnode_get+0x3c/0x54\n[ 1.260652] fwnode_get_nth_parent+0xd8/0xf4\n[ 1.264926] fwnode_full_name_string+0x3c/0xb4\n[ 1.269373] device_node_string+0x498/0x5b4\n[ 1.273561] pointer+0x41c/0x5d0\n[ 1.276793] vsnprintf+0x4d8/0x694\n[ 1.280198] vprintk_store+0x164/0x528\n[ 1.283951] vprintk_emit+0x98/0x164\n[ 1.287530] vprintk_default+0x44/0x6c\n[ 1.291284] vprintk+0xf0/0x134\n[ 1.294428] _printk+0x54/0x7c\n[ 1.297486] of_node_release+0xe8/0x128\n[ 1.301326] kobject_put+0x98/0xfc\n[ 1.304732] of_node_put+0x1c/0x28\n[ 1.308137] add_mtd_device+0x484/0x6d4\n[ 1.311977] add_mtd_partitions+0xf0/0x1d0\n[ 1.316078] parse_mtd_partitions+0x45c/0x518\n[ 1.320439] mtd_device_parse_register+0xb0/0x274\n[ 1.325147] gpmi_nand_probe+0x51c/0x650\n[ 1.329074] platform_probe+0xa8/0xd0\n[ 1.332740] really_probe+0x130/0x334\n[ 1.336406] __driver_probe_device+0xb4/0xe0\n[ 1.340681] driver_probe_device+0x3c/0x1f8\n[ 1.344869] __driver_attach+0xdc/0x1a4\n[ 1.348708] bus_for_each_dev+0x80/0xcc\n[ 1.352548] driver_attach+0x24/0x30\n[ 1.356127] bus_add_driver+0x108/0x1f4\n[ 1.359967] driver_register+0x78/0x114\n[ 1.363807] __platform_driver_register+0x24/0x30\n[ 1.368515] gpmi_nand_driver_init+0x1c/0x28\n[ 1.372798] do_one_initcall+0xbc/0x238\n[ 1.376638] do_initcall_level+0x94/0xb4\n[ 1.380565] do_initcalls+0x54/0x94\n[ 1.384058] do_basic_setup+0x1c/0x28\n[ 1.387724] kernel_init_freeable+0x110/0x188\n[ 1.392084] kernel_init+0x20/0x1a0\n[ 1.395578] ret_from_fork+0x10/0x20\n[ 1.399157] ---[ end trace 0000000000000000 ]---\n[ 1.403782] ------------[ cut here ]------------",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-416"
34+
],
35+
"severity": "HIGH",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2025-09-15T15:15:39Z"

‎advisories/unreviewed/2025/09/GHSA-g9p7-6qmh-h5c3/GHSA-g9p7-6qmh-h5c3.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-g9p7-6qmh-h5c3",
4-
"modified": "2025-09-15T15:31:26Z",
4+
"modified": "2025-12-04T21:31:01Z",
55
"published": "2025-09-15T15:31:26Z",
66
"aliases": [
77
"CVE-2022-50292"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dp: fix bridge lifetime\n\nDevice-managed resources allocated post component bind must be tied to\nthe lifetime of the aggregate DRM device or they will not necessarily be\nreleased when binding of the aggregate device is deferred.\n\nThis can lead resource leaks or failure to bind the aggregate device\nwhen binding is later retried and a second attempt to allocate the\nresources is made.\n\nFor the DP bridges, previously allocated bridges will leak on probe\ndeferral.\n\nFix this by amending the DP parser interface and tying the lifetime of\nthe bridge device to the DRM device rather than DP platform device.\n\nPatchwork: https://patchwork.freedesktop.org/patch/502667/",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -25,7 +30,7 @@
2530
],
2631
"database_specific": {
2732
"cwe_ids": [],
28-
"severity": null,
33+
"severity": "MODERATE",
2934
"github_reviewed": false,
3035
"github_reviewed_at": null,
3136
"nvd_published_at": "2025-09-15T15:15:40Z"

0 commit comments

Comments
 (0)