Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> module: ensure that kobject_put() is safe for module type kobjects<br /> <br /> In &amp;#39;lookup_or_create_module_kobject()&amp;#39;, an internal kobject is created<br /> using &amp;#39;module_ktype&amp;#39;. So call to &amp;#39;kobject_put()&amp;#39; on error handling<br /> path causes an attempt to use an uninitialized completion pointer in<br /> &amp;#39;module_kobject_release()&amp;#39;. In this scenario, we just want to release<br /> kobject without an extra synchronization required for a regular module<br /> unloading process, so adding an extra check whether &amp;#39;complete()&amp;#39; is<br /> actually required makes &amp;#39;kobject_put()&amp;#39; safe.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: ipset: fix region locking in hash types<br /> <br /> Region locking introduced in v5.6-rc4 contained three macros to handle<br /> the region locks: ahash_bucket_start(), ahash_bucket_end() which gave<br /> back the start and end hash bucket values belonging to a given region<br /> lock and ahash_region() which should give back the region lock belonging<br /> to a given hash bucket. The latter was incorrect which can lead to a<br /> race condition between the garbage collector and adding new elements<br /> when a hash type of set is defined with timeouts.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> openvswitch: Fix unsafe attribute parsing in output_userspace()<br /> <br /> This patch replaces the manual Netlink attribute iteration in<br /> output_userspace() with nla_for_each_nested(), which ensures that only<br /> well-formed attributes are processed.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe<br /> <br /> The spin lock tx_handling_spinlock in struct m_can_classdev is not<br /> being initialized. This leads the following spinlock bad magic<br /> complaint from the kernel, eg. when trying to send CAN frames with<br /> cansend from can-utils:<br /> <br /> | BUG: spinlock bad magic on CPU#0, cansend/95<br /> | lock: 0xff60000002ec1010, .magic: 00000000, .owner: /-1, .owner_cpu: 0<br /> | CPU: 0 UID: 0 PID: 95 Comm: cansend Not tainted 6.15.0-rc3-00032-ga79be02bba5c #5 NONE<br /> | Hardware name: MachineWare SIM-V (DT)<br /> | Call Trace:<br /> | [] dump_backtrace+0x1c/0x24<br /> | [] show_stack+0x28/0x34<br /> | [] dump_stack_lvl+0x4a/0x68<br /> | [] dump_stack+0x14/0x1c<br /> | [] spin_dump+0x62/0x6e<br /> | [] do_raw_spin_lock+0xd0/0x142<br /> | [] _raw_spin_lock_irqsave+0x20/0x2c<br /> | [] m_can_start_xmit+0x90/0x34a<br /> | [] dev_hard_start_xmit+0xa6/0xee<br /> | [] sch_direct_xmit+0x114/0x292<br /> | [] __dev_queue_xmit+0x3b0/0xaa8<br /> | [] can_send+0xc6/0x242<br /> | [] raw_sendmsg+0x1a8/0x36c<br /> | [] sock_write_iter+0x9a/0xee<br /> | [] vfs_write+0x184/0x3a6<br /> | [] ksys_write+0xa0/0xc0<br /> | [] __riscv_sys_write+0x14/0x1c<br /> | [] do_trap_ecall_u+0x168/0x212<br /> | [] handle_exception+0x146/0x152<br /> <br /> Initializing the spin lock in m_can_class_allocate_dev solves that<br /> problem.

APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation locally. Successful exploitation of this vulnerability can potentially impact of integrity.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: typec: ucsi: displayport: Fix NULL pointer access<br /> <br /> This patch ensures that the UCSI driver waits for all pending tasks in the<br /> ucsi_displayport_work workqueue to finish executing before proceeding with<br /> the partner removal.

An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint.

An authenticated user can perform command injection via unsanitized input to the NetFax Server’s ping functionality via the /test.php endpoint.

An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials.

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application performs insufficient validation of user-supplied data, which is used as arguments to string formatting functions. As a result, an attacker can pass a string containing special symbols (\r, \n, \t)to the application. This issue has been patched in version 1.8.178.

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘additional_settings’ parameter in all versions up to, and including, 5.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&amp;#39;s edd_receipt shortcode in all versions up to, and including, 3.3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.