https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:59:16 +0000 https://cve.radiocsirt.org/vuln/9akk108470a8948 <p>ABB became aware of vulnerabilities in IPGW product versions listed as affected in the advisory. An attacker who successfully exploits these vulnerabilities could potentially gain unauthorized access and potentially compromise the system&#39;s - and log-file - confidentiality, integrity and availability. ABB requires that the IP-address of an IPGW should not be accessible from the Internet or any other network considered insecure. The communication between IPGW and the associated Internet Service shall be outbound-initiated, bi-directional. Any unsolicited inbound connection shall be discarded. A common way to ensure this best practice is to operate IPGW behind a firewall. Researchers have reported 2518 CVEs to ABB which were identified using an automated scanning tool in a local network. ABB has analyzed these CVEs carefully and came to the following result:</p> <p>2074 - CVE&#39;s not impacting IPGW because it belongs to SW components inside the IPGW-Firmware-Image, that are not supported by the IPGW as a product, e.g. IPGW does not support: Display, USB-port, Keyboard, etc.</p> <p>7 - High Severity CVEs that belong to SW components integrated in IPGW-firmware-image. These CVE’s are considered to have a high severity because there are proof of concept (PoC) descriptions available. For cases that are not fixed, ABB was not able to find an appropriate solution.</p> <p>34 - Medium CVEs that belong to SW components integrated in IPGW-firmware-image. ABB defines a medium severity for CVE’s where…</p> <p>ABB became aware of vulnerabilities in IPGW product versions listed as affected in the advisory. An attacker who successfully exploits these vulnerabilities could potentially gain unauthorized access and potentially compromise the system&#39;s - and log-file - confidentiality, integrity and availability. ABB requires that the IP-address of an IPGW should not be accessible from the Internet or any other network considered insecure. The communication between IPGW and the associated Internet Service shall be outbound-initiated, bi-directional. Any unsolicited inbound connection shall be discarded. A common way to ensure this best practice is to operate IPGW behind a firewall. Researchers have reported 2518 CVEs to ABB which were identified using an automated scanning tool in a local network. ABB has analyzed these CVEs carefully and came to the following result:</p> <p>2074 - CVE&#39;s not impacting IPGW because it belongs to SW components inside the IPGW-Firmware-Image, that are not supported by the IPGW as a product, e.g. IPGW does not support: Display, USB-port, Keyboard, etc.</p> <p>7 - High Severity CVEs that belong to SW components integrated in IPGW-firmware-image. These CVE’s are considered to have a high severity because there are proof of concept (PoC) descriptions available. For cases that are not fixed, ABB was not able to find an appropriate solution.</p> <p>34 - Medium CVEs that belong to SW components integrated in IPGW-firmware-image. ABB defines a medium severity for CVE’s where…</p> https://cve.radiocsirt.org/vuln/9akk108470a8948 https://cve.radiocsirt.org/vuln/bdu:2025-03597 bdu:2025-03597 https://cve.radiocsirt.org/vuln/bdu:2025-03597 https://cve.radiocsirt.org/vuln/bell-cve-2024-56601 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2024-56601 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0133 certfr-2025-avi-0133 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0133 https://cve.radiocsirt.org/vuln/euvd-2026-346482 EUVD-2026-346482 https://cve.radiocsirt.org/vuln/euvd-2026-346482 https://cve.radiocsirt.org/vuln/fkie_cve-2024-56601 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: inet: do not leave a dangling sk pointer in inet_create()</p> <p>sock_init_data() attaches the allocated sk object to the provided sock object. If inet_create() fails later, the sk object is freed, but the sock object retains the dangling pointer, which may create use-after-free later.</p> <p>Clear the sk pointer in the sock object on error.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: inet: do not leave a dangling sk pointer in inet_create()</p> <p>sock_init_data() attaches the allocated sk object to the provided sock object. If inet_create() fails later, the sk object is freed, but the sock object retains the dangling pointer, which may create use-after-free later.</p> <p>Clear the sk pointer in the sock object on error.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-56601 https://cve.radiocsirt.org/vuln/ghsa-hjcm-xj34-6q2q <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: inet: do not leave a dangling sk pointer in inet_create()</p> <p>sock_init_data() attaches the allocated sk object to the provided sock object. If inet_create() fails later, the sk object is freed, but the sock object retains the dangling pointer, which may create use-after-free later.</p> <p>Clear the sk pointer in the sock object on error.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: inet: do not leave a dangling sk pointer in inet_create()</p> <p>sock_init_data() attaches the allocated sk object to the provided sock object. If inet_create() fails later, the sk object is freed, but the sock object retains the dangling pointer, which may create use-after-free later.</p> <p>Clear the sk pointer in the sock object on error.</p> https://cve.radiocsirt.org/vuln/ghsa-hjcm-xj34-6q2q https://cve.radiocsirt.org/vuln/icsa-23-348-10 <p>expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename. In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start o…</p> <p>expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename. In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start o…</p> https://cve.radiocsirt.org/vuln/icsa-23-348-10 https://cve.radiocsirt.org/vuln/msrc_cve-2024-56601 msrc_CVE-2024-56601 https://cve.radiocsirt.org/vuln/msrc_cve-2024-56601 https://cve.radiocsirt.org/vuln/oesa-2025-1158 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ila: call nf_unregister_net_hooks() sooner</p> <p>syzbot found an use-after-free Read in ila_nf_input [1]</p> <p>Issue here is that ila_xlat_exit_net() frees the rhashtable, then call nf_unregister_net_hooks().</p> <p>It should be done in the reverse way, with a synchronize_rcu().</p> <p>This is a good match for a pre_exit() method.</p> <p>[1] BUG: KASAN: use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline] BUG: KASAN: use-after-free in __rhashtable_lookup include/linux/rhashtable.h:604 [inline] BUG: KASAN: use-after-free in rhashtable_lookup include/linux/rhashtable.h:646 [inline] BUG: KASAN: use-after-free in rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672 Read of size 4 at addr ffff888064620008 by task ksoftirqd/0/16</p> <p>CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.11.0-rc4-syzkaller-00238-g2ad6d23f465a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: &amp;lt;TASK&amp;gt; __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 rht_key_hashfn include/linux/rhashtable.h:159 [inline] __rhashtable_lookup include/linux/rhashtable.h:604 [inline] rhashtable_lookup include/lin…</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ila: call nf_unregister_net_hooks() sooner</p> <p>syzbot found an use-after-free Read in ila_nf_input [1]</p> <p>Issue here is that ila_xlat_exit_net() frees the rhashtable, then call nf_unregister_net_hooks().</p> <p>It should be done in the reverse way, with a synchronize_rcu().</p> <p>This is a good match for a pre_exit() method.</p> <p>[1] BUG: KASAN: use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline] BUG: KASAN: use-after-free in __rhashtable_lookup include/linux/rhashtable.h:604 [inline] BUG: KASAN: use-after-free in rhashtable_lookup include/linux/rhashtable.h:646 [inline] BUG: KASAN: use-after-free in rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672 Read of size 4 at addr ffff888064620008 by task ksoftirqd/0/16</p> <p>CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.11.0-rc4-syzkaller-00238-g2ad6d23f465a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: &amp;lt;TASK&amp;gt; __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 rht_key_hashfn include/linux/rhashtable.h:159 [inline] __rhashtable_lookup include/linux/rhashtable.h:604 [inline] rhashtable_lookup include/lin…</p> https://cve.radiocsirt.org/vuln/oesa-2025-1158 https://cve.radiocsirt.org/vuln/rhsa-2025:6966 <p>kernel: xen-netfront: Fix NULL sring after live migration kernel: fscache: Fix oops due to race with cookie_lru and use_cookie kernel: tracing: Free buffers when a used dynamic event is removed kernel: net: tun: Fix use-after-free in tun_detach() kernel: hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails kernel: erofs/zmap.c: Fix incorrect offset calculation kernel: arm64/mm: fix incorrect file_map_count for non-leaf pmd/pud kernel: s390: avoid using global register for current_stack_pointer kernel: erofs: fix missing xas_retry() in fscache mode kernel: rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge kernel: remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init kernel: of: check previous kernel&#39;s ima-kexec-buffer against memory bounds kernel: coresight: Clear the connection field properly kernel: Linux kernel: Denial of Service in coresight: trbe kernel: rpmsg: char: Avoid double destroy of default endpoint kernel: coresight: cti: Fix hang in cti_disable_hw() kernel: lib/fonts: fix undefined behavior in bit shift for get_default_font kernel: Kernel: Denial of Service in pci_endpoint_test due to zero-length DMA mapping kernel: Linux kernel: Denial of Service in erofs due to memory leak kernel: erofs: fix missing unmap if z_erofs_get_extent_compressedlen() fails kernel: pipe: wakeup wr_wait after setting max_usage kernel: ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() kernel: qed/qed_sriov: guard against NULL derefs from qed_…</p> <p>kernel: xen-netfront: Fix NULL sring after live migration kernel: fscache: Fix oops due to race with cookie_lru and use_cookie kernel: tracing: Free buffers when a used dynamic event is removed kernel: net: tun: Fix use-after-free in tun_detach() kernel: hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails kernel: erofs/zmap.c: Fix incorrect offset calculation kernel: arm64/mm: fix incorrect file_map_count for non-leaf pmd/pud kernel: s390: avoid using global register for current_stack_pointer kernel: erofs: fix missing xas_retry() in fscache mode kernel: rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge kernel: remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init kernel: of: check previous kernel&#39;s ima-kexec-buffer against memory bounds kernel: coresight: Clear the connection field properly kernel: Linux kernel: Denial of Service in coresight: trbe kernel: rpmsg: char: Avoid double destroy of default endpoint kernel: coresight: cti: Fix hang in cti_disable_hw() kernel: lib/fonts: fix undefined behavior in bit shift for get_default_font kernel: Kernel: Denial of Service in pci_endpoint_test due to zero-length DMA mapping kernel: Linux kernel: Denial of Service in erofs due to memory leak kernel: erofs: fix missing unmap if z_erofs_get_extent_compressedlen() fails kernel: pipe: wakeup wr_wait after setting max_usage kernel: ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() kernel: qed/qed_sriov: guard against NULL derefs from qed_…</p> https://cve.radiocsirt.org/vuln/rhsa-2025:6966 https://cve.radiocsirt.org/vuln/ssa-355557 <p>nfsd: NULL dereference in nfs3svc_encode_getaclres. scsi: core: use-after-free vulnerability. NFSD: vulnerability caused by loff_t overflow on the server when a client reads near the maximum offset, causing the server to return an EINVAL error, which the client retries indefinitely, instead of handling out-of-range READ requests by returning a short result with an EOF flag. NFSD: Vulnerability caused by an underflow in ia_size due to a mismatch between signed and unsigned 64-bit file size values, which can cause issues when handling large file sizes from NFS clients. NFSD: Vulnerability handling large file sizes for NFSv3 improperly capping client size values larger than s64_max, leading to unexpected behavior and potential data corruption. sh: cpuinfo: warning for CONFIG_CPUMASK_OFFSTACK. When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are selected, cpu_max_bits_warn() generates a runtime warning when showing /proc/cpuinfo. A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables.</p> <p>The default behavior when the stack-protector detects an overflow is to terminate your application, resulting…</p> <p>nfsd: NULL dereference in nfs3svc_encode_getaclres. scsi: core: use-after-free vulnerability. NFSD: vulnerability caused by loff_t overflow on the server when a client reads near the maximum offset, causing the server to return an EINVAL error, which the client retries indefinitely, instead of handling out-of-range READ requests by returning a short result with an EOF flag. NFSD: Vulnerability caused by an underflow in ia_size due to a mismatch between signed and unsigned 64-bit file size values, which can cause issues when handling large file sizes from NFS clients. NFSD: Vulnerability handling large file sizes for NFSv3 improperly capping client size values larger than s64_max, leading to unexpected behavior and potential data corruption. sh: cpuinfo: warning for CONFIG_CPUMASK_OFFSTACK. When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are selected, cpu_max_bits_warn() generates a runtime warning when showing /proc/cpuinfo. A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables.</p> <p>The default behavior when the stack-protector detects an overflow is to terminate your application, resulting…</p> https://cve.radiocsirt.org/vuln/ssa-355557 https://cve.radiocsirt.org/vuln/suse-su-2025:02069-1 <p>Security update for the Linux Kernel RT (Live Patch 0 for SLE 15 SP6)</p> <p>Security update for the Linux Kernel RT (Live Patch 0 for SLE 15 SP6)</p> https://cve.radiocsirt.org/vuln/suse-su-2025:02069-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-56601 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 195 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: net: inet: do not leave a dangling sk pointer in inet_create() sock_init_data() attaches the allocated sk object to the provided sock object. If inet_create() fails later, the sk object is freed, but the sock object retains the dangling pointer, which may create use-after-free later. Clear the sk pointer in the sock object on error.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 195 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: net: inet: do not leave a dangling sk pointer in inet_create() sock_init_data() attaches the allocated sk object to the provided sock object. If inet_create() fails later, the sk object is freed, but the sock object retains the dangling pointer, which may create use-after-free later. Clear the sk pointer in the sock object on error.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-56601 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3762 <p>Ein lokaler Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen und um nicht näher beschriebene Effekte zu erzielen.</p> <p>Ein lokaler Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen und um nicht näher beschriebene Effekte zu erzielen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3762