Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fs/ntfs3: validate lcns_follow in log_replay conversion<br /> <br /> log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY<br /> records when replaying version 0 restart tables.<br /> <br /> During this conversion, the memmove() length is derived directly from<br /> the on-disk lcns_follow field:<br /> <br /> memmove(&amp;dp-&gt;vcn, &amp;dp0-&gt;vcn_low,<br /> 2 * sizeof(u64) +<br /> le32_to_cpu(dp-&gt;lcns_follow) * sizeof(u64));<br /> <br /> check_rstbl() validates restart table structure, but does not constrain<br /> per-entry lcns_follow values relative to the entry size. A malformed<br /> filesystem image can provide an oversized lcns_follow value, causing<br /> the conversion memmove() to access memory beyond the bounds of the<br /> allocated restart table buffer.<br /> <br /> The same field is later used to bound iteration over page_lcns[],<br /> so validating lcns_follow during conversion also prevents downstream<br /> out-of-bounds access from the same malformed metadata.<br /> <br /> Compute the maximum valid lcns_follow from the already-validated<br /> restart table entry size and reject entries that exceed this bound.<br /> Reuse the existing t16/t32 scratch variables already declared in<br /> log_replay() to avoid introducing new declarations.<br /> <br /> [almaz.alexandrovich@paragon-software.com: fixed the conflicts]

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path<br /> <br /> In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected,<br /> nvmet_req_uninit() is called unconditionally. However, if the command<br /> arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init()<br /> had returned false and percpu_ref_tryget_live() was never executed. The<br /> unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a<br /> refcount underflow, leading to a WARNING in<br /> percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and<br /> eventually a permanent workqueue deadlock.<br /> <br /> Check cmd-&gt;flags &amp; NVMET_TCP_F_INIT_FAILED before calling<br /> nvmet_req_uninit(), matching the existing pattern in<br /> nvmet_tcp_execute_request().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nvmet-tcp: Fix potential UAF when ddgst mismatch<br /> <br /> Shivam Kumar found via vulnerability testing:<br /> When data digest is enabled on an NVMe/TCP connection and a digest<br /> mismatch occurs on a non-final H2C_DATA PDU during an R2T-based<br /> data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst()<br /> calls nvmet_req_uninit() — which performs percpu_ref_put() on the<br /> submission queue — but does NOT mark the command as completed. It<br /> does not set cqe-&gt;status, does not modify rbytes_done, and does not<br /> clear any flag. When the subsequent fatal error triggers queue<br /> teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands,<br /> checks nvmet_tcp_need_data_in() for each one, and finds that the<br /> already-uninited command still appears to need data (because<br /> rbytes_done status == 0). It therefore calls<br /> nvmet_req_uninit() a second time on the same command — a double<br /> percpu_ref_put against a single percpu_ref_get.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop<br /> <br /> The loop in is_ap_in_tkip() iterates over IEs without verifying that<br /> enough bytes remain before dereferencing the IE header or its payload:<br /> <br /> - pIE-&gt;element_id and pIE-&gt;length are read without checking that<br /> i + sizeof(*pIE) data + 12,<br /> which requires pIE-&gt;length &gt;= 16. For WLAN_EID_RSN it compares<br /> pIE-&gt;data + 8, requiring pIE-&gt;length &gt;= 12. Neither requirement<br /> is checked.<br /> <br /> Add the missing IE header and payload bounds checks and guard each<br /> data access with an explicit pIE-&gt;length minimum, matching the<br /> pattern established in update_beacon_info().

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorized administrative access and complete system compromise.

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users&amp;#39; bookings.

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milestone IDs through the JSON-RPC API to access project planning information, milestone titles, descriptions, and timelines across all projects on the instance regardless of project membership.

The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accounts, allowing unauthenticated attackers to enumerate valid usernames and to brute-force passwords while bypassing brute-force protection Quiz and Survey Master (QSM) WordPress plugin before 11.1.3.

The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calendar.

Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply Schedule Appointments WordPress plugin before 1.6.12.4&amp;#39;s wp_kses_post() filter, so a double-encoded payload survives intake and is reintroduced as an executable element at render time.

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the login code, and redeem it through an unauthenticated AJAX action to log in as that user, including an administrator, without a password.

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.