CVE-2023-2513

kernel: ext4: use-after-free in ext4_xattr_set_entry()

A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus and 1 more

CVE-2023-2194

kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer()

An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to crash the system or potentially achieve code execution.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Linux Redhat

Products

Fedora Linux Kernel Enterprise Linux and 2 more

CVE-2023-1073

kernel: HID: check empty report_list in hid_validate_values()

A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a malicious USB device. This flaw allows a local user to crash or potentially escalate their privileges on the system.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Linux Redhat

Products

Fedora Linux Kernel Enterprise Linux and 2 more

CVE-2015-8104

virt: guest to host DoS by triggering an infinite loop in microcode via #DB exception

The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c.

CVSS 3.1 · 10 Critical EPSS 2.5% KEV · Not listed

Vendors

Canonical Debian Linux and 3 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 7 more

CVE-2022-3108

kernel: drm/amdkfd: NULL pointer dereference in kfd_parse_subtype_iolink()

An issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c lacks check of the return value of kmemdup().

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2022-3107

kernel: hv_netvsc: NULL pointer dereference in netvsc_get_ethtool_stats()

An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kvmalloc_array() and will cause the null pointer dereference.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2022-3105

kernel: RDMA/uverbs: NULL pointer dereference in uapi_finalize()

An issue was discovered in the Linux kernel through 5.16-rc6. uapi_finalize in drivers/infiniband/core/uverbs_uapi.c lacks check of kmalloc_array().

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2022-3106

kernel: sfc_ef100: NULL pointer dereference in ef100_update_stats()

An issue was discovered in the Linux kernel through 5.16-rc6. ef100_update_stats in drivers/net/ethernet/sfc/ef100_nic.c lacks check of the return value of kmalloc().

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2017-5109

chromium-browser: ui spoofing in browser

Inappropriate implementation of unload handler handling in permission prompts in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to display UI on a non attacker controlled tab via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Chrome and 6 more

CVE-2017-5108

chromium-browser: type confusion in pdfium

Type confusion in PDFium in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted PDF file.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Android Chrome and 6 more

CVE-2017-5107

chromium-browser: user information leak via svg

A timing attack in SVG rendering in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to extract pixel values from a cross-origin page being iframe'd via a crafted HTML page.

CVSS 3.1 · 5.3 Medium EPSS 1.7% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Chrome Linux Kernel and 5 more

CVE-2017-5106

chromium-browser: url spoofing in omnibox

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5105

chromium-browser: url spoofing in omnibox

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5103

chromium-browser: uninitialized use in skia

Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Chrome and 6 more

CVE-2017-5102

chromium-browser: uninitialized use in skia

Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5101

chromium-browser: url spoofing in omnibox

Inappropriate implementation in Omnibox in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Chrome and 6 more

CVE-2017-5099

chromium-browser: out-of-bounds write in ppapi

Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to potentially gain privilege elevation via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

Debian Google Linux and 1 more

Products

Debian Linux Chrome Linux Kernel and 1 more

CVE-2017-5098

chromium-browser: use after free in v8

A use after free in V8 in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 15.5% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5095

chromium-browser: out-of-bounds write in pdfium

Stack overflow in PDFium in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to potentially exploit stack corruption via a crafted PDF file.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Chrome and 6 more

CVE-2017-5094

chromium-browser: type confusion in extensions

Type confusion in extensions JavaScript bindings in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more