Open Source Vulnerabilities

nsd

NLnet Labs Unbound, up to and including version 1

qt5-qtwebengine

Inappropriate implementation in Gamepad API in Google Chrome prior to 98

xen, xen, xen

xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly from Xen

libx11

integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1

qt5-qtwebengine

Expat (aka libexpat) before 2

xen, xen, xen

inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status

libx11

integer overflow vulnerability leading to a double-free was found in libX11

qt5-qtwebengine

Use after free in Blink Layout in Google Chrome on Android prior to 99

xen, xen, xen

long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a domain may create to map grants offered by other domains

libx11

LookupCol

hylafaxplus

HylaFAX+ through 7

qt5-qtwebengine

Type confusion in V8 in Google Chrome prior to 99

xen, xen, xen

grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory

hylafaxplus

In HylaFAX+ through 7

libx11

vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function

qt5-qtwebengine

Out of bounds memory access in Mojo in Google Chrome prior to 99

xen, xen, xen

IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE

libx11

vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function

qt5-qtwebengine

Use after free in ANGLE in Google Chrome prior to 99

xen, xen, xen

IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE

libx11

vulnerability was found in libX11 due to a boundary condition within the _XkbReadKeySyms() function

qt5-qtwebengine

Use after free in Portals in Google Chrome prior to 100

xen, xen, xen

IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE

qt5-qtwebengine

Inappropriate implementation in Web Cursor in Google Chrome prior to 100

xen, xen, xen

x86: TSX Async Abort protections not restored after S3 This issue relates to the TSX Async Abort speculative security vulnerability

qt5-qtwebengine

Use after free in storage in Google Chrome prior to 100

xen, xen, xen

Observable response discrepancy in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access

wazuh-dashboard-plugins

wazuh-dashboard-plugins

nodejs-current

Node

wazuh-dashboard-plugins

wazuh-dashboard-plugins

wazuh-dashboard-plugins

qt5-qtwebengine

Use after free in regular expressions in Google Chrome prior to 100

cryptsetup

vulnerability was found in upstream release cryptsetup-2

xen, xen, xen

inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s) issuing such commands

snort

Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated, remote attacker to cause a denial of servic...

wazuh-dashboard-plugins

qt5-qtwebengine

Type confusion in V8 in Google Chrome prior to 100

xen, xen, xen

xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e

cryptsetup

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device

qt5-qtwebengine

Use after free in Dev Tools in Google Chrome prior to 101

xen, xen, xen

HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disposed of afterwards by calling a specific set of functions

qt5-qtwebengine

Use after free in Media in Google Chrome prior to 99

xen, xen, xen

issue was discovered in Xen 4

qt5-qtwebengine

Type confusion in V8 in Google Chrome prior to 103

vips

vips_foreign_load_gif_scan_image in foreign/gifload

actions-runner

actions-runner

xen, xen, xen

issue was discovered in Xen 4