Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> crypto: hisilicon/qm - increase the memory of local variables<br /> <br /> Increase the buffer to prevent stack overflow by fuzz test. The maximum<br /> length of the qos configuration buffer is 256 bytes. Currently, the value<br /> of the &amp;#39;val buffer&amp;#39; is only 32 bytes. The sscanf does not check the dest<br /> memory length. So the &amp;#39;val buffer&amp;#39; may stack overflow.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fbdev: fbcon: release buffer when fbcon_do_set_font() failed<br /> <br /> syzbot is reporting memory leak at fbcon_do_set_font() [1], for<br /> commit a5a923038d70 ("fbdev: fbcon: Properly revert changes when<br /> vc_resize() failed") missed that the buffer might be newly allocated<br /> by fbcon_set_font().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure<br /> <br /> On error situation `clp-&gt;cl_cb_conn.cb_xprt` should not be given<br /> a reference to the xprt otherwise both client cleanup and the<br /> error handling path of the caller call to put it. Better to<br /> delay handing over the reference to a later branch.<br /> <br /> [ 72.530665] refcount_t: underflow; use-after-free.<br /> [ 72.531933] WARNING: CPU: 0 PID: 173 at lib/refcount.c:28 refcount_warn_saturate+0xcf/0x120<br /> [ 72.533075] Modules linked in: nfsd(OE) nfsv4(OE) nfsv3(OE) nfs(OE) lockd(OE) compat_nfs_ssc(OE) nfs_acl(OE) rpcsec_gss_krb5(OE) auth_rpcgss(OE) rpcrdma(OE) dns_resolver fscache netfs grace rdma_cm iw_cm ib_cm sunrpc(OE) mlx5_ib mlx5_core mlxfw pci_hyperv_intf ib_uverbs ib_core xt_MASQUERADE nf_conntrack_netlink nft_counter xt_addrtype nft_compat br_netfilter bridge stp llc nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set overlay nf_tables nfnetlink crct10dif_pclmul crc32_pclmul ghash_clmulni_intel xfs serio_raw virtio_net virtio_blk net_failover failover fuse [last unloaded: sunrpc]<br /> [ 72.540389] CPU: 0 PID: 173 Comm: kworker/u16:5 Tainted: G OE 5.15.82-dan #1<br /> [ 72.541511] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-3.module+el8.7.0+1084+97b81f61 04/01/2014<br /> [ 72.542717] Workqueue: nfsd4_callbacks nfsd4_run_cb_work [nfsd]<br /> [ 72.543575] RIP: 0010:refcount_warn_saturate+0xcf/0x120<br /> [ 72.544299] Code: 55 00 0f 0b 5d e9 01 50 98 00 80 3d 75 9e 39 08 00 0f 85 74 ff ff ff 48 c7 c7 e8 d1 60 8e c6 05 61 9e 39 08 01 e8 f6 51 55 00 0b 5d e9 d9 4f 98 00 80 3d 4b 9e 39 08 00 0f 85 4c ff ff ff 48<br /> [ 72.546666] RSP: 0018:ffffb3f841157cf0 EFLAGS: 00010286<br /> [ 72.547393] RAX: 0000000000000026 RBX: ffff89ac6231d478 RCX: 0000000000000000<br /> [ 72.548324] RDX: ffff89adb7c2c2c0 RSI: ffff89adb7c205c0 RDI: ffff89adb7c205c0<br /> [ 72.549271] RBP: ffffb3f841157cf0 R08: 0000000000000000 R09: c0000000ffefffff<br /> [ 72.550209] R10: 0000000000000001 R11: ffffb3f841157ad0 R12: ffff89ac6231d180<br /> [ 72.551142] R13: ffff89ac6231d478 R14: ffff89ac40c06180 R15: ffff89ac6231d4b0<br /> [ 72.552089] FS: 0000000000000000(0000) GS:ffff89adb7c00000(0000) knlGS:0000000000000000<br /> [ 72.553175] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> [ 72.553934] CR2: 0000563a310506a8 CR3: 0000000109a66000 CR4: 0000000000350ef0<br /> [ 72.554874] Call Trace:<br /> [ 72.555278] <br /> [ 72.555614] svc_xprt_put+0xaf/0xe0 [sunrpc]<br /> [ 72.556276] nfsd4_process_cb_update.isra.11+0xb7/0x410 [nfsd]<br /> [ 72.557087] ? update_load_avg+0x82/0x610<br /> [ 72.557652] ? cpuacct_charge+0x60/0x70<br /> [ 72.558212] ? dequeue_entity+0xdb/0x3e0<br /> [ 72.558765] ? queued_spin_unlock+0x9/0x20<br /> [ 72.559358] nfsd4_run_cb_work+0xfc/0x270 [nfsd]<br /> [ 72.560031] process_one_work+0x1df/0x390<br /> [ 72.560600] worker_thread+0x37/0x3b0<br /> [ 72.561644] ? process_one_work+0x390/0x390<br /> [ 72.562247] kthread+0x12f/0x150<br /> [ 72.562710] ? set_kthread_struct+0x50/0x50<br /> [ 72.563309] ret_from_fork+0x22/0x30<br /> [ 72.563818] <br /> [ 72.564189] ---[ end trace 031117b1c72ec616 ]---<br /> [ 72.566019] list_add corruption. next-&gt;prev should be prev (ffff89ac4977e538), but was ffff89ac4763e018. (next=ffff89ac4763e018).<br /> [ 72.567647] ------------[ cut here ]------------

An issue Clip Bucket v.5.5.2 Build#90 allows a remote attacker to execute arbitrary codes via the file_downloader.php and the file parameter

In realme BackupRestore app v15.1.12_2810c08_250314, improper URI scheme handling in com.coloros.pc.PcToolMainActivity allows local attackers to cause a crash and potential XSS via crafted ADB intents.

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Backlog item representations do not verify the permissions of the child trackers. Users might see tracker names they should not have access to. This vulnerability is fixed in Tuleap Community Edition 16.11.99.1757427600 and Tuleap Enterprise Edition 16.11-6 and 16.10-8.

Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.129.4, there is a a cross-site scripting (XSS) vulnerability when handling chat message in lobe-chat that can be escalated to remote code execution on the user’s machine. In lobe-chat, when the response from the server is like , it will be rendered with the lobeArtifact node, instead of the plain text. However, when the type of the lobeArtifact is image/svg+xml , it will be rendered as the SVGRender component, which internally uses dangerouslySetInnerHTML to set the content of the svg, resulting in XSS attack. Any party capable of injecting content into chat messages, such as hosting a malicious page for prompt injection, operating a compromised MCP server, or leveraging tool integrations, can exploit this vulnerability. This vulnerability is fixed in 1.129.4.

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). A bad actor can flood the inbox of a user by repeatedly sending invites (duplicate). The issue is fixed in commit 83c3fc7676c5dbbe1fd5092d21d95a10c7b48615.

A vulnerability has been found in youth-is-as-pale-as-poetry e-learning 1.0. Impacted is the function encryptSecret of the file e-learning-master\exam-api\src\main\java\com\yf\exam\ability\shiro\jwt\JwtUtils.java of the component JWT Token Handler. The manipulation leads to insufficiently random values. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used.

A vulnerability was found in whuan132 AIBattery up to 1.0.9. The affected element is an unknown function of the file AIBatteryHelper/XPC/BatteryXPCService.swift of the component com.collweb.AIBatteryHelper. The manipulation results in missing authentication. The attack requires a local approach. The exploit has been made public and could be used.

A vulnerability was determined in itsourcecode Student Information Management System 1.0. The impacted element is an unknown function of the file /admin/modules/class/index.php. This manipulation of the argument classId causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

A flaw has been found in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This issue affects some unknown processing of the file /check_profile.php. Executing manipulation of the argument profile_id can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.