Auto-Update: 2024-10-21T22:00:29.106281+00:00

fkie-cad · Oct 21, 2024 · e4f66fd · e4f66fd
1 parent e2479bf
commit e4f66fd
Show file tree

Hide file tree

Showing 194 changed files with 8,204 additions and 436 deletions.
diff --git a/CVE-2019/CVE-2019-251xx/CVE-2019-25154.json b/CVE-2019/CVE-2019-251xx/CVE-2019-25154.json
@@ -2,8 +2,8 @@
   "id": "CVE-2019-25154",
   "sourceIdentifier": "[email protected]",
   "published": "2024-07-16T23:15:10.407",
-  "lastModified": "2024-07-17T13:34:20.520",
-  "vulnStatus": "Undergoing Analysis",
+  "lastModified": "2024-10-21T21:16:21.877",
+  "vulnStatus": "Analyzed",
   "cveTags": [],
   "descriptions": [
     {
@@ -15,15 +15,74 @@
       "value": "La implementaci\u00f3n inadecuada en iframe en Google Chrome anterior a 77.0.3865.75 permit\u00eda a un atacante remoto realizar potencialmente un escape de la sandbox a trav\u00e9s de una p\u00e1gina HTML manipulada. (Severidad de seguridad de Chromium: media)"
     }
   ],
-  "metrics": {},
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "[email protected]",
+        "type": "Primary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "NONE",
+          "userInteraction": "REQUIRED",
+          "scope": "CHANGED",
+          "confidentialityImpact": "HIGH",
+          "integrityImpact": "HIGH",
+          "availabilityImpact": "HIGH",
+          "baseScore": 9.6,
+          "baseSeverity": "CRITICAL"
+        },
+        "exploitabilityScore": 2.8,
+        "impactScore": 6.0
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "[email protected]",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "NVD-CWE-noinfo"
+        }
+      ]
+    }
+  ],
+  "configurations": [
+    {
+      "nodes": [
+        {
+          "operator": "OR",
+          "negate": false,
+          "cpeMatch": [
+            {
+              "vulnerable": true,
+              "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
+              "versionEndExcluding": "77.0.3865.75",
+              "matchCriteriaId": "35E0B140-F006-4C6D-86AB-D822C9827E15"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "url": "https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html",
-      "source": "[email protected]"
+      "source": "[email protected]",
+      "tags": [
+        "Vendor Advisory"
+      ]
     },
     {
       "url": "https://issues.chromium.org/issues/40094752",
-      "source": "[email protected]"
+      "source": "[email protected]",
+      "tags": [
+        "Issue Tracking"
+      ]
     }
   ]
 }
diff --git a/CVE-2022/CVE-2022-489xx/CVE-2022-48946.json b/CVE-2022/CVE-2022-489xx/CVE-2022-48946.json
@@ -0,0 +1,53 @@
+{
+  "id": "CVE-2022-48946",
+  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
+  "published": "2024-10-21T20:15:06.020",
+  "lastModified": "2024-10-21T20:15:06.020",
+  "vulnStatus": "Received",
+  "cveTags": [],
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Fix preallocation discarding at indirect extent boundary\n\nWhen preallocation extent is the first one in the extent block, the\ncode would corrupt extent tree header instead. Fix the problem and use\nudf_delete_aext() for deleting extent to avoid some code duplication."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://git.kernel.org/stable/c/12a88f572d6d94b5c0b72e2d1782cc2e96ac06cf",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/1a075f4a549481ce6e8518d8379f193ccec6b746",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/4d835efd561dfb9bf5409f11f4ecd428d5d29226",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/63dbbd8f1499b0a161e701a04aa50148d60bd1f7",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/72f651c96c8aadf087fd782d551bf7db648a8c2e",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/7665857f88557c372da35534165721156756f77f",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/ae56d9a017724f130cf1a263dd82a78d2a6e3852",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/c8b6fa4511a7900db9fb0353b630d4d2ed1ba99c",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/cfe4c1b25dd6d2f056afc00b7c98bcb3dd0b1fc3",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    }
+  ]
+}
diff --git a/CVE-2022/CVE-2022-489xx/CVE-2022-48947.json b/CVE-2022/CVE-2022-489xx/CVE-2022-48947.json
@@ -0,0 +1,49 @@
+{
+  "id": "CVE-2022-48947",
+  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
+  "published": "2024-10-21T20:15:06.150",
+  "lastModified": "2024-10-21T20:15:06.150",
+  "vulnStatus": "Received",
+  "cveTags": [],
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix u8 overflow\n\nBy keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases\nmultiple times and eventually it will wrap around the maximum number\n(i.e., 255).\nThis patch prevents this by adding a boundary check with\nL2CAP_MAX_CONF_RSP\n\nBtmon log:\nBluetooth monitor ver 5.64\n= Note: Linux version 6.1.0-rc2 (x86_64)                               0.264594\n= Note: Bluetooth subsystem version 2.22                               0.264636\n@ MGMT Open: btmon (privileged) version 1.22                  {0x0001} 0.272191\n= New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0)          [hci0] 13.877604\n@ RAW Open: 9496 (privileged) version 2.22                   {0x0002} 13.890741\n= Open Index: 00:00:00:00:00:00                                [hci0] 13.900426\n(...)\n> ACL Data RX: Handle 200 flags 0x00 dlen 1033             #32 [hci0] 14.273106\n        invalid packet size (12 != 1033)\n        08 00 01 00 02 01 04 00 01 10 ff ff              ............\n> ACL Data RX: Handle 200 flags 0x00 dlen 1547             #33 [hci0] 14.273561\n        invalid packet size (14 != 1547)\n        0a 00 01 00 04 01 06 00 40 00 00 00 00 00        ........@.....\n> ACL Data RX: Handle 200 flags 0x00 dlen 2061             #34 [hci0] 14.274390\n        invalid packet size (16 != 2061)\n        0c 00 01 00 04 01 08 00 40 00 00 00 00 00 00 04  ........@.......\n> ACL Data RX: Handle 200 flags 0x00 dlen 2061             #35 [hci0] 14.274932\n        invalid packet size (16 != 2061)\n        0c 00 01 00 04 01 08 00 40 00 00 00 07 00 03 00  ........@.......\n= bluetoothd: Bluetooth daemon 5.43                                   14.401828\n> ACL Data RX: Handle 200 flags 0x00 dlen 1033             #36 [hci0] 14.275753\n        invalid packet size (12 != 1033)\n        08 00 01 00 04 01 04 00 40 00 00 00              ........@..."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://git.kernel.org/stable/c/19a78143961a197de8502f4f29c453b913dc3c29",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/49d5867819ab7c744852b45509e8469839c07e0e",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/5550bbf709c323194881737fd290c4bada9e6ead",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/95f1847a361c7b4bf7d74c06ecb6968455082c1a",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/9fdc79b571434af7bc742da40a3405f038b637a7",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/ad528fde0702903208d0a79d88d5a42ae3fc235b",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/bcd70260ef56e0aee8a4fc6cd214a419900b0765",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/f3fe6817156a2ad4b06f01afab04638a34d7c9a6",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    }
+  ]
+}
diff --git a/CVE-2022/CVE-2022-489xx/CVE-2022-48948.json b/CVE-2022/CVE-2022-489xx/CVE-2022-48948.json
@@ -0,0 +1,53 @@
+{
+  "id": "CVE-2022-48948",
+  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
+  "published": "2024-10-21T20:15:06.230",
+  "lastModified": "2024-10-21T20:15:06.230",
+  "vulnStatus": "Received",
+  "cveTags": [],
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: uvc: Prevent buffer overflow in setup handler\n\nSetup function uvc_function_setup permits control transfer\nrequests with up to 64 bytes of payload (UVC_MAX_REQUEST_SIZE),\ndata stage handler for OUT transfer uses memcpy to copy req->actual\nbytes to uvc_event->data.data array of size 60. This may result\nin an overflow of 4 bytes."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://git.kernel.org/stable/c/06fd17ee92c8f1704c7e54ec0fd50ae0542a49a5",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/4972e3528b968665b596b5434764ff8fd9446d35",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/4c92670b16727365699fe4b19ed32013bab2c107",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/6b41a35b41f77821db24f2d8f66794b390a585c5",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/7b1f773277a72f9756d47a41b94e43506cce1954",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/b8fb1cba934ea122b50f13a4f9d6fc4fdc43d2be",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/bc8380fe5768c564f921f7b4eaba932e330b9e4b",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/c79538f32df12887f110dcd6b9c825b482905f24",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/d1a92bb8d697f170d93fe922da763d7d156b8841",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    }
+  ]
+}
diff --git a/CVE-2022/CVE-2022-489xx/CVE-2022-48949.json b/CVE-2022/CVE-2022-489xx/CVE-2022-48949.json
@@ -0,0 +1,49 @@
+{
+  "id": "CVE-2022-48949",
+  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
+  "published": "2024-10-21T20:15:06.337",
+  "lastModified": "2024-10-21T20:15:06.337",
+  "vulnStatus": "Received",
+  "cveTags": [],
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Initialize mailbox message for VF reset\n\nWhen a MAC address is not assigned to the VF, that portion of the message\nsent to the VF is not set. The memory, however, is allocated from the\nstack meaning that information may be leaked to the VM. Initialize the\nmessage buffer to 0 so that no information is passed to the VM in this\ncase."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://git.kernel.org/stable/c/367e1e3399dbc56fc669740c4ab60e35da632b0e",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/51fd5ede7ed42f272682a0c33d6f0767b3484a3d",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/a6629659af3f5c6a91e3914ea62554c975ab77f4",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/c383c7c35c7bc15e07a04eefa060a8a80cbeae29",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/c581439a977545d61849a72e8ed631cfc8a2a3c1",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/de5dc44370fbd6b46bd7f1a1e00369be54a041c8",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/ef1d739dd1f362aec081278ff92f943c31eb177a",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/f2479c3daaabccbac6c343a737615d0c595c6dc4",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    }
+  ]
+}
diff --git a/CVE-2022/CVE-2022-489xx/CVE-2022-48950.json b/CVE-2022/CVE-2022-489xx/CVE-2022-48950.json
@@ -0,0 +1,29 @@
+{
+  "id": "CVE-2022-48950",
+  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
+  "published": "2024-10-21T20:15:06.440",
+  "lastModified": "2024-10-21T20:15:06.440",
+  "vulnStatus": "Received",
+  "cveTags": [],
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix perf_pending_task() UaF\n\nPer syzbot it is possible for perf_pending_task() to run after the\nevent is free()'d. There are two related but distinct cases:\n\n - the task_work was already queued before destroying the event;\n - destroying the event itself queues the task_work.\n\nThe first cannot be solved using task_work_cancel() since\nperf_release() itself might be called from a task_work (____fput),\nwhich means the current->task_works list is already empty and\ntask_work_cancel() won't be able to find the perf_pending_task()\nentry.\n\nThe simplest alternative is extending the perf_event lifetime to cover\nthe task_work.\n\nThe second is just silly, queueing a task_work while you know the\nevent is going away makes no sense and is easily avoided by\nre-arranging how the event is marked STATE_DEAD and ensuring it goes\nthrough STATE_OFF on the way down."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://git.kernel.org/stable/c/517e6a301f34613bff24a8e35b5455884f2d83d8",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/78e1317a174edbfd1182599bf76c092a2877672c",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/8bffa95ac19ff27c8261904f89d36c7fcf215d59",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    }
+  ]
+}
diff --git a/CVE-2022/CVE-2022-489xx/CVE-2022-48951.json b/CVE-2022/CVE-2022-489xx/CVE-2022-48951.json
@@ -0,0 +1,49 @@
+{
+  "id": "CVE-2022-48951",
+  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
+  "published": "2024-10-21T20:15:06.530",
+  "lastModified": "2024-10-21T20:15:06.530",
+  "vulnStatus": "Received",
+  "cveTags": [],
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()\n\nThe bounds checks in snd_soc_put_volsw_sx() are only being applied to the\nfirst channel, meaning it is possible to write out of bounds values to the\nsecond channel in stereo controls. Add appropriate checks."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://git.kernel.org/stable/c/1798b62d642e7b3d4ea3403914c3caf4e438465d",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/18a168d85eadcfd45f015b5ecd2a97801b959e43",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/50b5f6d4d9d2d69a7498c44fd8b26e13d73d3d98",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/56288987843c3cb343e81e5fa51549cbaf541bd0",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/9796d07c753164b7e6b0d7ef23fb4482840a9ef8",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/97eea946b93961fffd29448dcda7398d0d51c4b2",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/cf1c225f1927891ae388562b78ced7840c3723b9",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    },
+    {
+      "url": "https://git.kernel.org/stable/c/cf611d786796ec33da09d8c83d7d7f4e557b27de",
+      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
+    }
+  ]
+}