Skip to content

Commit d7d2ddb

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-676m-39hm-wg2r GHSA-h2jq-7w25-hghw GHSA-hmmc-gg67-83cw GHSA-hxvp-53j6-m4qh GHSA-mqxf-7jx4-2h8p GHSA-v5cj-xc9v-xg6m GHSA-wgqj-6qph-jqhq GHSA-6237-9hpw-gcm6 GHSA-9p37-p7vc-233f GHSA-jw2v-jc28-rfh8 GHSA-xfq4-7gv9-v3w5
1 parent b6d47d4 commit d7d2ddb

File tree

11 files changed

+206
-18
lines changed

11 files changed

+206
-18
lines changed

‎advisories/unreviewed/2024/06/GHSA-676m-39hm-wg2r/GHSA-676m-39hm-wg2r.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-676m-39hm-wg2r",
4-
"modified": "2024-06-27T12:30:47Z",
4+
"modified": "2025-10-21T00:30:25Z",
55
"published": "2024-06-19T15:30:53Z",
66
"aliases": [
77
"CVE-2024-38579"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: bcm - Fix pointer arithmetic\n\nIn spu2_dump_omd() value of ptr is increased by ciph_key_len\ninstead of hash_iv_len which could lead to going beyond the\nbuffer boundaries.\nFix this bug by changing ciph_key_len to hash_iv_len.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -57,7 +62,7 @@
5762
],
5863
"database_specific": {
5964
"cwe_ids": [],
60-
"severity": null,
65+
"severity": "MODERATE",
6166
"github_reviewed": false,
6267
"github_reviewed_at": null,
6368
"nvd_published_at": "2024-06-19T14:15:17Z"

‎advisories/unreviewed/2024/06/GHSA-h2jq-7w25-hghw/GHSA-h2jq-7w25-hghw.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-h2jq-7w25-hghw",
4-
"modified": "2024-06-19T15:30:53Z",
4+
"modified": "2025-10-21T00:30:25Z",
55
"published": "2024-06-19T15:30:53Z",
66
"aliases": [
77
"CVE-2024-38564"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE\n\nbpf_prog_attach uses attach_type_to_prog_type to enforce proper\nattach type for BPF_PROG_TYPE_CGROUP_SKB. link_create uses\nbpf_prog_get and relies on bpf_prog_attach_check_attach_type\nto properly verify prog_type <> attach_type association.\n\nAdd missing attach_type enforcement for the link_create case.\nOtherwise, it's currently possible to attach cgroup_skb prog\ntypes to other cgroup hooks.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -33,7 +38,7 @@
3338
],
3439
"database_specific": {
3540
"cwe_ids": [],
36-
"severity": null,
41+
"severity": "MODERATE",
3742
"github_reviewed": false,
3843
"github_reviewed_at": null,
3944
"nvd_published_at": "2024-06-19T14:15:16Z"

‎advisories/unreviewed/2024/06/GHSA-hmmc-gg67-83cw/GHSA-hmmc-gg67-83cw.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,9 @@
3737
}
3838
],
3939
"database_specific": {
40-
"cwe_ids": [],
40+
"cwe_ids": [
41+
"CWE-908"
42+
],
4143
"severity": "MODERATE",
4244
"github_reviewed": false,
4345
"github_reviewed_at": null,

‎advisories/unreviewed/2024/06/GHSA-hxvp-53j6-m4qh/GHSA-hxvp-53j6-m4qh.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-hxvp-53j6-m4qh",
4-
"modified": "2024-06-19T15:30:53Z",
4+
"modified": "2025-10-21T00:30:25Z",
55
"published": "2024-06-19T15:30:53Z",
66
"aliases": [
77
"CVE-2024-38580"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nepoll: be better about file lifetimes\n\nepoll can call out to vfs_poll() with a file pointer that may race with\nthe last 'fput()'. That would make f_count go down to zero, and while\nthe ep->mtx locking means that the resulting file pointer tear-down will\nbe blocked until the poll returns, it means that f_count is already\ndead, and any use of it won't actually get a reference to the file any\nmore: it's dead regardless.\n\nMake sure we have a valid ref on the file pointer before we call down to\nvfs_poll() from the epoll routines.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -37,7 +42,7 @@
3742
],
3843
"database_specific": {
3944
"cwe_ids": [],
40-
"severity": null,
45+
"severity": "MODERATE",
4146
"github_reviewed": false,
4247
"github_reviewed_at": null,
4348
"nvd_published_at": "2024-06-19T14:15:18Z"

‎advisories/unreviewed/2024/06/GHSA-mqxf-7jx4-2h8p/GHSA-mqxf-7jx4-2h8p.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,9 @@
5353
}
5454
],
5555
"database_specific": {
56-
"cwe_ids": [],
56+
"cwe_ids": [
57+
"CWE-416"
58+
],
5759
"severity": "MODERATE",
5860
"github_reviewed": false,
5961
"github_reviewed_at": null,

‎advisories/unreviewed/2024/06/GHSA-v5cj-xc9v-xg6m/GHSA-v5cj-xc9v-xg6m.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-v5cj-xc9v-xg6m",
4-
"modified": "2024-06-27T12:30:47Z",
4+
"modified": "2025-10-21T00:30:25Z",
55
"published": "2024-06-19T15:30:53Z",
66
"aliases": [
77
"CVE-2024-38558"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix overwriting ct original tuple for ICMPv6\n\nOVS_PACKET_CMD_EXECUTE has 3 main attributes:\n - OVS_PACKET_ATTR_KEY - Packet metadata in a netlink format.\n - OVS_PACKET_ATTR_PACKET - Binary packet content.\n - OVS_PACKET_ATTR_ACTIONS - Actions to execute on the packet.\n\nOVS_PACKET_ATTR_KEY is parsed first to populate sw_flow_key structure\nwith the metadata like conntrack state, input port, recirculation id,\netc. Then the packet itself gets parsed to populate the rest of the\nkeys from the packet headers.\n\nWhenever the packet parsing code starts parsing the ICMPv6 header, it\nfirst zeroes out fields in the key corresponding to Neighbor Discovery\ninformation even if it is not an ND packet.\n\nIt is an 'ipv6.nd' field. However, the 'ipv6' is a union that shares\nthe space between 'nd' and 'ct_orig' that holds the original tuple\nconntrack metadata parsed from the OVS_PACKET_ATTR_KEY.\n\nND packets should not normally have conntrack state, so it's fine to\nshare the space, but normal ICMPv6 Echo packets or maybe other types of\nICMPv6 can have the state attached and it should not be overwritten.\n\nThe issue results in all but the last 4 bytes of the destination\naddress being wiped from the original conntrack tuple leading to\nincorrect packet matching and potentially executing wrong actions\nin case this packet recirculates within the datapath or goes back\nto userspace.\n\nND fields should not be accessed in non-ND packets, so not clearing\nthem should be fine. Executing memset() only for actual ND packets to\navoid the issue.\n\nInitializing the whole thing before parsing is needed because ND packet\nmay not contain all the options.\n\nThe issue only affects the OVS_PACKET_CMD_EXECUTE path and doesn't\naffect packets entering OVS datapath from network interfaces, because\nin this case CT metadata is populated from skb after the packet is\nalready parsed.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -56,8 +61,10 @@
5661
}
5762
],
5863
"database_specific": {
59-
"cwe_ids": [],
60-
"severity": null,
64+
"cwe_ids": [
65+
"CWE-665"
66+
],
67+
"severity": "MODERATE",
6168
"github_reviewed": false,
6269
"github_reviewed_at": null,
6370
"nvd_published_at": "2024-06-19T14:15:15Z"

‎advisories/unreviewed/2024/06/GHSA-wgqj-6qph-jqhq/GHSA-wgqj-6qph-jqhq.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-wgqj-6qph-jqhq",
4-
"modified": "2024-06-27T12:30:47Z",
4+
"modified": "2025-10-21T00:30:25Z",
55
"published": "2024-06-19T15:30:53Z",
66
"aliases": [
77
"CVE-2024-38567"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: carl9170: add a proper sanity check for endpoints\n\nSyzkaller reports [1] hitting a warning which is caused by presence\nof a wrong endpoint type at the URB sumbitting stage. While there\nwas a check for a specific 4th endpoint, since it can switch types\nbetween bulk and interrupt, other endpoints are trusted implicitly.\nSimilar warning is triggered in a couple of other syzbot issues [2].\n\nFix the issue by doing a comprehensive check of all endpoints\ntaking into account difference between high- and full-speed\nconfiguration.\n\n[1] Syzkaller report:\n...\nWARNING: CPU: 0 PID: 4721 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504\n...\nCall Trace:\n <TASK>\n carl9170_usb_send_rx_irq_urb+0x273/0x340 drivers/net/wireless/ath/carl9170/usb.c:504\n carl9170_usb_init_device drivers/net/wireless/ath/carl9170/usb.c:939 [inline]\n carl9170_usb_firmware_finish drivers/net/wireless/ath/carl9170/usb.c:999 [inline]\n carl9170_usb_firmware_step2+0x175/0x240 drivers/net/wireless/ath/carl9170/usb.c:1028\n request_firmware_work_func+0x130/0x240 drivers/base/firmware_loader/main.c:1107\n process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289\n worker_thread+0x669/0x1090 kernel/workqueue.c:2436\n kthread+0x2e8/0x3a0 kernel/kthread.c:376\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308\n </TASK>\n\n[2] Related syzkaller crashes:",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -57,7 +62,7 @@
5762
],
5863
"database_specific": {
5964
"cwe_ids": [],
60-
"severity": null,
65+
"severity": "MODERATE",
6166
"github_reviewed": false,
6267
"github_reviewed_at": null,
6368
"nvd_published_at": "2024-06-19T14:15:16Z"

‎advisories/unreviewed/2025/10/GHSA-6237-9hpw-gcm6/GHSA-6237-9hpw-gcm6.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6237-9hpw-gcm6",
4+
"modified": "2025-10-21T00:30:26Z",
5+
"published": "2025-10-21T00:30:26Z",
6+
"aliases": [
7+
"CVE-2025-54764"
8+
],
9+
"details": "Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54764"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-10-ssbleed-mstep"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2025-10-20T22:15:37Z"
32+
}
33+
}

‎advisories/unreviewed/2025/10/GHSA-9p37-p7vc-233f/GHSA-9p37-p7vc-233f.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9p37-p7vc-233f",
4+
"modified": "2025-10-21T00:30:26Z",
5+
"published": "2025-10-21T00:30:26Z",
6+
"aliases": [
7+
"CVE-2025-12001"
8+
],
9+
"details": "Lack of application manifest sanitation could lead to potential stored XSS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12001"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://azure-access.com/security-advisories"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-20"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-20T22:15:36Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-jw2v-jc28-rfh8/GHSA-jw2v-jc28-rfh8.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jw2v-jc28-rfh8",
4+
"modified": "2025-10-21T00:30:25Z",
5+
"published": "2025-10-21T00:30:25Z",
6+
"aliases": [
7+
"CVE-2018-25118"
8+
],
9+
"details": "GeoVision embedded IP devices, confirmed on GV-BX1500 and GV-MFD1501, contain a remote command injection vulnerability via /PictureCatch.cgi that enables an attacker to execute arbitrary commands on the device. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-19 08:55:13.141502 UTC.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25118"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/mcw0/PoC/blob/fb06efe05b7e240dc88ff31eb30e1ef345509dce/Geovision-PoC.py#L15"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.exploit-db.com/exploits/43982"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.geovision.com.tw/blog/?cat=14"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/geovision-command-injection-rce-picture-catch-cgi"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-78"
42+
],
43+
"severity": "CRITICAL",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-10-20T22:15:35Z"
47+
}
48+
}

0 commit comments

Comments
 (0)