Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-35229 State: PUBLISHED Published: 2024-05-27T16:20:27.432Z Last Updated: 2024-09-03T16:03:02.966Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: matter-labs Products: era-compiler-solidity Problem Types: CWE-696 Description: ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to version 1.3.10, there is a very specific pattern `f(a(),b()); check_if_a_executed_last()` in Yul that exposes a bug in evaluation order of Yul function arguments. This vulnerability has been fixed in version 1.3.10. As a workaround, update and redeploy affected contracts. Additional Analyst Notes: - CVE Program Container: - CISA A
10. As a workaround, update and redeploy affected contracts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matter-labs/era-compiler-solidity/security/advisories/GHSA-jf9w-7f5g-j95p - https://github.com/matter-labs/era-compiler-solidity/commit/46ce047b51576495779b9f67534207d8154eab79
CVE ID: CVE-2024-35230 State: PUBLISHED Published: 2024-12-16T22:18:19.896Z Last Updated: 2024-12-17T14:40:36.212Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: geoserver Products: geoserver Problem Types: CWE-200 Description: GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. In affected versions the welcome and about page includes version and revision information about the software in use (including library and components used). This information is sensitive from a security point of view because it allows software used by the server to be easily identified. This issue has been patched in versi
oint of view because it allows software used by the server to be easily identified. This issue has been patched in version 2.26.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/geoserver/geoserver/security/advisories/GHSA-6pfc-w86r-54q6 - https://github.com/geoserver/geoserver/commit/74fdab745a5deff20ac99abca24d8695fe1a52f8 - https://github.com/geoserver/geoserver/commit/8cd1590a604a10875de67b04995f1952f631f920
CVE ID: CVE-2024-35231 State: PUBLISHED Published: 2024-05-27T16:40:08.678Z Last Updated: 2024-08-02T03:07:46.936Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: rack Products: rack-contrib Problem Types: CWE-770 Description: rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not constrained to any limitation. This would lead to allocating resources on the server side with no limitation and a potential denial of service by remotely user-controlled data. Version 2.5.0 c
n the server side with no limitation and a potential denial of service by remotely user-controlled data. Version 2.5.0 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/rack/rack-contrib/security/advisories/GHSA-8c8q-2xw3-j869 - https://github.com/rack/rack-contrib/commit/0eec2a9836329051c6742549e65a94a4c24fe6f7
CVE ID: CVE-2024-35232 State: PUBLISHED Published: 2024-05-24T20:44:09.233Z Last Updated: 2024-08-02T03:07:46.857Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: huandu Products: facebook Problem Types: CWE-209 Description: github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. access_token can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/huandu/facebook/security/advisories/GHSA-3f65-m234-9mxr - https://github.com/huand
ner: References: - https://github.com/huandu/facebook/security/advisories/GHSA-3f65-m234-9mxr - https://github.com/huandu/facebook/commit/8b34431b91b32903c8821b1d7621bf81a029d8e4 - https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633 - https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30 - https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567
CVE ID: CVE-2024-35234 State: PUBLISHED Published: 2024-07-03T18:23:10.179Z Last Updated: 2024-08-02T03:07:46.903Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L) Vendors: discourse Products: discourse Problem Types: CWE-79 Description: Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, an attacker can execute arbitrary JavaScript on users’ browsers by posting a specific URL containing maliciously crafted meta tags. This issue only affects sites with Content Security Polic (CSP) disabled. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.
ntent Security Polic (CSP) disabled. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. As a workaround, ensure CSP is enabled on the forum. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/discourse/discourse/security/advisories/GHSA-5chg-hm8c-wc58 - https://github.com/discourse/discourse/commit/26aef0c288839378b9de5819e96eac8cf4ea60fd - https://github.com/discourse/discourse/commit/311b737c910cf0a69f61e1b8bc0b78374b6619d2
CVE ID: CVE-2024-35235 State: PUBLISHED Published: 2024-06-11T14:13:23.771Z Last Updated: 2025-02-21T16:56:42.752Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: OpenPrinting Products: cups Problem Types: CWE-59, CWE-252 Description: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Given that cupsd is often running as root, this can result in the chang
, providing world-writable access to the target. Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable. Given the aforementioned Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a `FoomaticRIPCommandLine` argument, arbitrary user and group (not root) co
inting with a printer configured by PPD with a `FoomaticRIPCommandLine` argument, arbitrary user and group (not root) command execution could be achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f - https://github.com/OpenPrinting/cups/commit/ff1f8a623e090dee8a8aadf12a6a4b25efac143d - https://git.launchpad.net/ubuntu/+source/apparmor/tree/profiles/apparmor.d/abstractions/user-tmp#n21 - https://github.com/Ope
://git.launchpad.net/ubuntu/+source/apparmor/tree/profiles/apparmor.d/abstractions/user-tmp#n21 - https://github.com/OpenPrinting/cups/blob/aba917003c8de55e5bf85010f0ecf1f1ddd1408e/cups/http-addr.c#L229-L240 - http://www.openwall.com/lists/oss-security/2024/06/11/1 - http://www.openwall.com/lists/oss-security/2024/06/12/4 - http://www.openwall.com/lists/oss-security/2024/06/12/5 - https://lists.debian.org/debian-lts-announce/2024/06/msg00001.html
CVE ID: CVE-2024-35236 State: PUBLISHED Published: 2024-05-27T17:03:46.175Z Last Updated: 2024-08-02T03:07:46.867Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: advplyr Products: audiobookshelf Problem Types: CWE-79 Description: Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.10.0, opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Attacking a user with high privileges (upload, creation of libraries) can lead to remote code execution (RCE) in the worst case. This was tested on version 2.9.0 on Windows, but an arbitrary file write is powerful enough as is and should easily lea
This was tested on version 2.9.0 on Windows, but an arbitrary file write is powerful enough as is and should easily lead to RCE on Linux, too. Version 2.10.0 contains a patch for the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-7j99-76cj-q9pg - https://github.com/advplyr/audiobookshelf/commit/ce7f891b9b2cb57c6644aaf96f89a8bda6307664 - https://github.com/advplyr/audiobookshelf/assets/36849099/46f6dfe0-9860-4ec0-a987-b3a553f7e45d - https://github.com/advplyr/audiobookshelf/blob/04ed4810fdfcafc2e82db536edc5870e3f937d00/client/components/readers/EpubReader.vue#L319 - ht
/advplyr/audiobookshelf/blob/04ed4810fdfcafc2e82db536edc5870e3f937d00/client/components/readers/EpubReader.vue#L319 - https://github.com/advplyr/audiobookshelf/releases/tag/v2.10.0
CVE ID: CVE-2024-35237 State: PUBLISHED Published: 2024-05-27T17:07:09.361Z Last Updated: 2024-08-02T03:07:46.921Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ZelnickB Products: mit-identibot Problem Types: CWE-862 Description: MIT IdentiBot is an open-source Discord bot written in Node.js that verifies individuals' affiliations with MIT, grants them roles in a Discord server, and stores information about them in a database backend. A vulnerability that exists prior to commit 48e3e5e7ead6777fa75d57c7711c8e55b501c24e impacts all users who have performed verification with an instance of MIT IdentiBot that meets the following conditions: The instance of Ident
have performed verification with an instance of MIT IdentiBot that meets the following conditions: The instance of IdentiBot is tied to a "public" Discord application—i.e., users other than the API access registrant can add it to servers; *and* the instance has not yet been patched. In affected versions, IdentiBot does not check that a server is authorized before allowing members to execute slash and user commands in that server. As a result, any user can join IdentiBot to their server and then use commands (e.g., `/kerbid`) to reveal the full name and other information about a Discord user who has verified their affiliation with MIT using IdentiBot. The latest version of MIT IdentiBot conta
ut a Discord user who has verified their affiliation with MIT using IdentiBot. The latest version of MIT IdentiBot contains a patch for this vulnerability (implemented in commit 48e3e5e7ead6777fa75d57c7711c8e55b501c24e). There is no way to prevent exploitation of the vulnerability without the patch. To prevent exploitation of the vulnerability, all vulnerable instances of IdentiBot should be taken offline until they have been updated. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ZelnickB/mit-identibot/security/advisories/GHSA-h8r9-7r8x-78v6 - https://github.com/ZelnickB/mit-identibot/commit/48e3e5e7ead6777fa75d57c7711c8e55b501c2
advisories/GHSA-h8r9-7r8x-78v6 - https://github.com/ZelnickB/mit-identibot/commit/48e3e5e7ead6777fa75d57c7711c8e55b501c24e
CVE ID: CVE-2024-35238 State: PUBLISHED Published: 2024-05-27T17:12:20.570Z Last Updated: 2024-09-03T15:27:31.490Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: stacklok Products: minder Problem Types: CWE-770 Description: Minder by Stacklok is an open source software supply chain security platform. Minder prior to version 0.0.51 is vulnerable to a denial-of-service (DoS) attack which could allow an attacker to crash the Minder server and deny other users access to it. The root cause of the vulnerability is that Minders sigstore verifier reads an untrusted response entirely into memory without enforcing a limit on the response body. An attacker can exploit
reads an untrusted response entirely into memory without enforcing a limit on the response body. An attacker can exploit this by making Minder make a request to an attacker-controlled endpoint which returns a response with a large body which will crash the Minder server. Specifically, the point of failure is where Minder parses the response from the GitHub attestations endpoint in `getAttestationReply`. Here, Minder makes a request to the `orgs/$owner/attestations/$checksumref` GitHub endpoint (line 285) and then parses the response into the `AttestationReply` (line 295). The way Minder parses the response on line 295 makes it prone to DoS if the response is large enough. Essentially, the re
he way Minder parses the response on line 295 makes it prone to DoS if the response is large enough. Essentially, the response needs to be larger than the machine has available memory. Version 0.0.51 contains a patch for this issue. The content that is hosted at the `orgs/$owner/attestations/$checksumref` GitHub attestation endpoint is controlled by users including unauthenticated users to Minders threat model. However, a user will need to configure their own Minder settings to cause Minder to make Minder send a request to fetch the attestations. The user would need to know of a package whose attestations were configured in such a way that they would return a large response when fetching the
of a package whose attestations were configured in such a way that they would return a large response when fetching them. As such, the steps needed to carry out this attack would look as such: 1. The attacker adds a package to ghcr.io with attestations that can be fetched via the `orgs/$owner/attestations/$checksumref` GitHub endpoint. 2. The attacker registers on Minder and makes Minder fetch the attestations. 3. Minder fetches attestations and crashes thereby being denied of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/stacklok/minder/security/advisories/GHSA-8fmj-33gw-g7pw - https://github.com/stacklok/minder/commit
- https://github.com/stacklok/minder/security/advisories/GHSA-8fmj-33gw-g7pw - https://github.com/stacklok/minder/commit/fe321d345b4f738de6a06b13207addc72b59f892 - https://github.com/stacklok/minder/blob/daccbc12e364e2d407d56b87a13f7bb24cbdb074/internal/verifier/sigstore/container/container.go#L271-L300
CVE ID: CVE-2024-35239 State: PUBLISHED Published: 2024-05-28T20:15:28.512Z Last Updated: 2024-08-02T03:07:46.872Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: umbraco Products: Umbraco.Forms.Issues Problem Types: CWE-79 Description: Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refer
ons (13.0.1, 12.2.2, 10.5.3, 8.13.13). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-p572-p2rj-q5f4 - https://docs.umbraco.com/umbraco-forms/developer/configuration#editing-configuration-values - https://docs.umbraco.com/umbraco-forms/release-notes#id-13.0.1-january-16th-2024 - https://docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notes - https://docs.umbraco.com/umbraco-forms/v/12.forms.latest/release-notes#id-12.2.2-january-16th-2024
CVE ID: CVE-2024-35240 State: PUBLISHED Published: 2024-05-28T20:15:32.382Z Last Updated: 2024-08-19T19:02:57.975Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: umbraco Products: Umbraco.Commerce.Issues Problem Types: CWE-79 Description: Umbraco Commerce is an open source dotnet ecommerce solution. In affected versions there exists a stored Cross-site scripting (XSS) issue which would enable attackers to inject malicious code into Print Functionality. This issue has been addressed in versions 12.1.4, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP
de. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/umbraco/Umbraco.Commerce.Issues/security/advisories/GHSA-rpj9-xjwm-wr6w - https://docs.umbraco.com/umbraco-commerce/release-notes#id-13.0.0-december-13th-2023
CVE ID: CVE-2024-35241 State: PUBLISHED Published: 2024-06-10T21:19:47.123Z Last Updated: 2025-04-21T15:20:35.089Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: composer Products: composer Problem Types: CWE-77 Description: Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-d
on 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c - https://github.com/composer/composer/commit/b93fc6ca437da35ae73d667d0618749c763b67d4 - https://github.com/composer/composer/commit/ee28354ca8d33c15949ad7de2ce6656ba3f68704 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/ - https://lists.fedoraproject.org/archives/list/packag
lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC/
CVE ID: CVE-2024-35242 State: PUBLISHED Published: 2024-06-10T21:23:44.040Z Last Updated: 2025-02-13T17:52:34.786Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: composer Products: composer Problem Types: CWE-77 Description: Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories. Additional Analyst
r 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmf - https://github.com/composer/composer/commit/6bd43dff859c597c09bd03a7e7d6443822d0a396 - https://github.com/composer/composer/commit/fc57b93603d7d90b71ca8ec77b1c8a9171fdb467 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV
s://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC/
CVE ID: CVE-2024-35244 State: PUBLISHED Published: 2024-11-26T07:38:06.435Z Last Updated: 2025-11-04T17:20:50.877Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Sharp Corporation, Toshiba Tec Corporation Products: Multiple MFPs (multifunction printers) Problem Types: CWE-798 Description: There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by examining the coredump), these accounts can be used to re-configure the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [Refe
oduct names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://global.sharp/products/copier/info/info_security_2024-05.html - https://jp.sharp/business/print/information/info_security_2024-05.html - https://www.toshibatec.com/information/20240531_02.html - https://www.toshibatec.co.jp/information/20240531_02.html - https://jvn.jp/en/vu/JVNVU93051062/ - https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html
CVE ID: CVE-2024-35245 State: PUBLISHED Published: 2024-11-13T21:10:41.111Z Last Updated: 2024-11-14T19:42:56.517Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) PROSet/Wireless WiFi software for Windows Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path element in some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01167.html
CVE ID: CVE-2024-35246 State: PUBLISHED Published: 2024-06-20T22:11:40.479Z Last Updated: 2024-08-02T03:07:46.901Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Westermo Products: L210-F2G Lynx Problem Types: CWE-799 Description: An attacker may be able to cause a denial-of-service condition by sending many packets repeatedly. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-172-03
CVE ID: CVE-2024-35247 State: PUBLISHED Published: 2024-06-24T13:56:50.704Z Last Updated: 2025-05-04T09:05:17.767Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fpga: region: add owner module and take its refcount The current implementation of the fpga region assumes that the low-level module registers a driver for the parent device and uses its owner pointer to take the module's refcount. This approach is problematic since it can lead to a null pointer dereference while attempting to get the region during programming if the parent device does not have a driver. To address this problem, add a module owner pointer to the fpga_r