Open Source Vulnerabilities

qt5-qtwebengine

Heap buffer overflow in Swiftshader in Google Chrome prior to 96

isync

flaw was found in mbsync versions prior to 1

pam-u2f

Yubico pam-u2f before 1

xen, xen, xen

Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE

qt5-qtwebengine

Heap buffer overflow in Media streams API in Google Chrome prior to 97

xen, xen, xen

Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE

qt5-qtwebengine

Type confusion in V8 in Google Chrome prior to 97

xen, xen, xen

Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access

qt5-qtbase

issue was discovered in Qt through 5

vorbis-tools

Buffer Overflow vulnerability in Vorbis-tools v

qt5-qtwebengine

Use after free in SwiftShader in Google Chrome prior to 97

xen, xen, xen

Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access

qt5-qtbase

issue was discovered in Qt before 5

qt5-qtwebengine

Heap buffer overflow in ANGLE in Google Chrome prior to 97

xen, xen, xen

Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access

qt5-qtbase

issue was discovered in Qt before 5

qt5-qtwebengine

Inappropriate implementation in Navigation in Google Chrome prior to 97

xen, xen, xen

x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE

qt5-qtwebengine

Inappropriate implementation in Autofill in Google Chrome prior to 97

xen, xen, xen

x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE

qt5-qtwebengine

Inappropriate implementation in Navigation in Google Chrome prior to 97

xen, xen, xen

x86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in addition to a regular reference count

qt5-qtwebengine

Inappropriate implementation in Blink in Google Chrome prior to 97

xen, xen, xen

IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE

qt5-qtwebengine

Inappropriate implementation in Compositing in Google Chrome prior to 97

iwd

Access Point functionality in eapol_auth_key_handle in eapol

xen, xen, xen

IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE

jetty-runner

Eclipse Jetty provides a web server and servlet container

qt5-qtwebengine

Policy bypass in Blink in Google Chrome prior to 97

slock

slock allows attackers to bypass the screen lock via vectors involving an invalid password hash, which triggers a NULL pointer dereference and crash

xen, xen, xen

IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE

pango

Gnome Pango 1

qt5-qtwebengine

Use after free in Safe browsing in Google Chrome prior to 97

nodetaint, grpc, netdata, trafficserver9, trafficserver9, varnish, jetty-runner

HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023

xen, xen, xen

IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE

qt5-qtwebengine

Inappropriate implementation in Storage in Google Chrome prior to 97

xen, xen, xen

race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide

qt5-qtwebengine

Use after free in Web packaging in Google Chrome prior to 97

rsyslog

issue was discovered in Rsyslog v8

xen, xen, xen

Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XEN_DMOP_track_dirty_vram (was named HVMOP_track_dirty_vram before Xen 4

qt5-qtwebengine

Use after free in Scheduling in Google Chrome prior to 97

soundtouch

WavFileBase class in WavFile

rsyslog

issue was discovered in Rsyslog v8

xen, xen, xen

Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involves an iterative operation in particular when cleaning up a...

qt5-qtwebengine

Inappropriate implementation in Service Worker API in Google Chrome prior to 97

soundtouch

WavFileBase class in WavFile

rsyslog

contrib/pmdb2diag/pmdb2diag

xen, xen, xen

PV guest could DoS Xen while unmapping a grant To address XSA-380, reference counting was introduced for grant mappings for the case where a PV guest would have the IOMMU enabled

qt5-qtwebengine

Heap buffer overflow in PDFium in Google Chrome prior to 97

soundtouch

BPMDetect class in BPMDetect