Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ulnerable to a TarSlip vulnerability. An attacker able to supply a malicious CRD file into a Karmada initialization could write arbitrary files in arbitrary paths of the filesystem. From Karmada version 1.12.0, when processing custom CRDs files, CRDs archive verification is utilized to enhance file system robustness. A workaround is available. Someone who needs to set flag `--crd` to customize the CRD files required for Karmada initialization when using `karmadactl init` to set up Karmada can manually inspect the CRD files to check whether they contain sequences such as `../` that would alter file paths, to determine if they potentially include malicious files. When using karmada-operator to
/` that would alter file paths, to determine if they potentially include malicious files. When using karmada-operator to set up Karmada, one must upgrade one's karmada-operator to one of the fixed versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/karmada-io/karmada/security/advisories/GHSA-cwrh-575j-8vr3 - https://github.com/karmada-io/karmada/pull/5703 - https://github.com/karmada-io/karmada/pull/5713 - https://github.com/karmada-io/karmada/commit/40ec488b18a461ab0f871d2c9ec8665b361f0d50 - https://github.com/karmada-io/karmada/commit/f78e7e2a3d02bed04e9bc7abd3ae7b3ac56862d2
CVE ID: CVE-2024-56515 State: PUBLISHED Published: 2025-01-16T19:11:02.868Z Last Updated: 2025-02-12T20:31:21.997Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: t2bot Products: matrix-media-repo Problem Types: CWE-502 Description: Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. If SVG or JPEGXL thumbnailers are enabled (they are disabled by default), a user may upload a file which claims to be either of these types and request a thumbnail to invoke a different decoder in ImageMagick. In some ImageMagick installations, this includes the capability to run Ghostscript to decode the image/file. If MP4 thumbnailers
ImageMagick installations, this includes the capability to run Ghostscript to decode the image/file. If MP4 thumbnailers are enabled (also disabled by default), the same issue as above may occur with the ffmpeg installation instead. MMR uses a number of other decoders for all other file types when preparing thumbnails. Theoretical issues are possible with these decoders, however in testing they were not possible to exploit. This is fixed in MMR v1.3.8. MMR now inspects the mimetype of media prior to thumbnailing, and picks a thumbnailer based on those results instead of relying on user-supplied values. This may lead to fewer thumbnails when obscure file shapes are used. This also helps narro
ying on user-supplied values. This may lead to fewer thumbnails when obscure file shapes are used. This also helps narrow scope of theoretical issues with all decoders MMR uses for thumbnails. Users are advised to upgrade. Users unable to upgrade may disable the SVG, JPEGXL, and MP4 thumbnail types in the MMR config which prevents the decoders from being invoked. Further disabling uncommon file types on the server is recommended to limit risk surface. Containers and other similar technologies may also be used to limit the impact of vulnerabilities in external decoders, like ImageMagick and ffmpeg. Some installations of ImageMagick may disable "unsafe" file types, like PDFs, already. This opt
ImageMagick and ffmpeg. Some installations of ImageMagick may disable "unsafe" file types, like PDFs, already. This option can be replicated to other environments as needed. ffmpeg may be compiled with limited decoders/codecs. The Docker image for MMR disables PDFs and similar formats by default. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-rcxc-wjgw-579r - https://github.com/t2bot/matrix-media-repo/releases/tag/v1.3.8
CVE ID: CVE-2024-56516 State: PUBLISHED Published: 2024-12-30T16:19:47.571Z Last Updated: 2024-12-30T16:48:21.594Z Vendors: RockChinQ Products: free-one-api Problem Types: CWE-328 Description: free-one-api allows users to access large language model reverse engineering libraries through the standard OpenAI API format. In versions up to and including 1.0.1, MD5 is used to hash passwords before sending them to the backend. MD5 is a cryptographically broken hashing algorithm and is no longer considered secure for password storage or transmission. It is vulnerable to collision attacks and can be easily cracked using modern hardware, exposing user credentials to potential compromise. As of time o
attacks and can be easily cracked using modern hardware, exposing user credentials to potential compromise. As of time of publication, a replacement for MD5 has not been committed to the free-one-api GitHub repository. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RockChinQ/free-one-api/security/advisories/GHSA-36cc-58vm-wm4h - https://github.com/RockChinQ/free-one-api/blob/4d6ee42ffbb224b95be32c26cabc28d54d01bf78/web/src/main.js#L15
CVE ID: CVE-2024-56517 State: PUBLISHED Published: 2024-12-30T16:36:08.785Z Last Updated: 2024-12-30T17:22:50.748Z Vendors: tltneon Products: lgsl Problem Types: CWE-79 Description: LGSL (Live Game Server List) provides online status lists for online video games. Versions up to and including 6.2.1 contain a reflected cross-site scripting vulnerability in the `Referer` HTTP header. The vulnerability allows attackers to inject arbitrary JavaScript code, which is reflected in the HTML response without proper sanitization. When crafted malicious input is provided in the `Referer` header, it is echoed back into an HTML attribute in the application’s response. Commit 7ecb839df9358d21f64cdbff5b2536
r` header, it is echoed back into an HTML attribute in the application’s response. Commit 7ecb839df9358d21f64cdbff5b2536af25a77de1 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tltneon/lgsl/security/advisories/GHSA-ggwq-xc72-33r3 - https://github.com/tltneon/lgsl/commit/7ecb839df9358d21f64cdbff5b2536af25a77de1 - https://github.com/tltneon/lgsl/blob/master/lgsl_files/lgsl_list.php#L20-L24
CVE ID: CVE-2024-56518 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-22T14:34:31.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hazelcast Management Center through 6.0 allows remote code execution via a JndiLoginModule user.provider.url in a hazelcast-client XML document (aka a client configuration file), which can be uploaded at the /cluster-connections URI. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.hazelcast.com/management-center/6.0-snapshot/getting-started/install - https://gist.github.com/azraelxuemo/c3d42739aa3306a41111ef603dc65b4c
CVE ID: CVE-2024-56519 State: PUBLISHED Published: 2024-12-27T00:00:00.000Z Last Updated: 2025-11-03T19:32:18.795Z Vendors: tecnick Products: tcpdf Problem Types: n/a Description: An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/tecnickcom/TCPDF/commit/c9f41cbb84880bdb4fc3e0a9d287214d1ac4d7f4 - https://tcpdf.org - https://github.com/tecnickcom/TCPDF/compare/6.7.8...6.8.0
CVE ID: CVE-2024-56520 State: PUBLISHED Published: 2024-12-27T00:00:00.000Z Last Updated: 2025-11-03T19:32:20.167Z Vendors: tecnick Products: tcpdf Problem Types: n/a Description: An issue was discovered in tc-lib-pdf-font before 2.6.4, as used in TCPDF before 6.8.0 and other products. Fonts are mishandled, e.g., FontBBox for Type 1 and TrueType fonts is misparsed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://tcpdf.org - https://github.com/tecnickcom/TCPDF/compare/6.7.8...6.8.0 - https://github.com/tecnickcom/TCPDF/commit/a0a02efe487cc39bd5223359e916dbeafb5cd6fe - https://github.com/tecnickcom/tc-lib-pdf-font/commit/30012e333ae611c514ec2dc
/a0a02efe487cc39bd5223359e916dbeafb5cd6fe - https://github.com/tecnickcom/tc-lib-pdf-font/commit/30012e333ae611c514ec2dc7cb370bbf4da4e677 - https://github.com/tecnickcom/tc-lib-pdf-font/compare/2.6.2...2.6.4
CVE ID: CVE-2024-56521 State: PUBLISHED Published: 2024-12-27T00:00:00.000Z Last Updated: 2025-03-24T17:45:16.482Z Vendors: tecnick Products: tcpdf Problem Types: CWE-295 Description: An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://tcpdf.org - https://github.com/tecnickcom/TCPDF/compare/6.7.8...6.8.0 - https://github.com/tecnickcom/TCPDF/commit/aab43ab0a824e956276141a28a24c7c0be20f554
CVE ID: CVE-2024-56522 State: PUBLISHED Published: 2024-12-27T00:00:00.000Z Last Updated: 2025-11-03T19:32:21.561Z Vendors: tecnick Products: tcpdf Problem Types: n/a Description: An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://tcpdf.org - https://github.com/tecnickcom/TCPDF/compare/6.7.8...6.8.0 - https://github.com/tecnickcom/TCPDF/commit/d54b97cec33f4f1a5ad81119a82085cad93cec89 - https://www.php.net/manual/en/types.comparisons.php
CVE ID: CVE-2024-56523 State: PUBLISHED Published: 2025-05-12T00:00:00.000Z Last Updated: 2025-05-12T22:07:33.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by placing random data in the HTTP request body when using the HTTP GET method. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://radware.com/solutions/cloud-security/ - https://www.kb.cert.org/vuls/id/722229
CVE ID: CVE-2024-56524 State: PUBLISHED Published: 2025-05-12T00:00:00.000Z Last Updated: 2025-05-12T22:07:28.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by adding a special character to the request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://radware.com/solutions/cloud-security/ - https://www.kb.cert.org/vuls/id/722229
CVE ID: CVE-2024-56525 State: PUBLISHED Published: 2025-02-24T00:00:00.000Z Last Updated: 2025-02-25T14:26:32.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as super admin in the journal context, and insert a backdoor plugin, by uploading a crafted XML document as a User XML Plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://openjournaltheme.com/user-xml-fatal-vulnerabilities-for-ojs-omp-ops-3-3-0-21-cve-2024-56525/
CVE ID: CVE-2024-56526 State: PUBLISHED Published: 2025-05-13T00:00:00.000Z Last Updated: 2025-05-14T14:02:05.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OXID eShop before 7. CMS pages in combination with Smarty may display user information if a CMS page contains a Smarty syntax error. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugs.oxid-esales.com/view.php?id=7743
CVE ID: CVE-2024-56527 State: PUBLISHED Published: 2024-12-27T00:00:00.000Z Last Updated: 2025-11-03T19:32:22.949Z Vendors: tecnick Products: tcpdf Problem Types: CWE-79 Description: An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://tcpdf.org - https://github.com/tecnickcom/TCPDF/compare/6.7.8...6.8.0 - https://github.com/tecnickcom/TCPDF/commit/11778aaa2d9e30a9ae1c1ee97ff349344f0ad6e1 - https://andrea0.medium.com/analysis-of-cve-2024-56527-dbdab6962add
CVE ID: CVE-2024-56528 State: PUBLISHED Published: 2025-04-03T00:00:00.000Z Last Updated: 2025-04-07T18:54:12.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: This vulnerability affects Snowplow Collector 3.x before 3.3.0 (unless it’s set up behind a reverse proxy that establishes payload limits). It involves sending very large payloads to the Collector and can render it unresponsive to the rest of the requests. As a result, data would not enter the pipeline and would be potentially lost. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.snowplow.io/hc/en-us/articles/26318139354909-Update-Critical-Snowplow-Security-Updates-Impact-on-Open-Source-S
//support.snowplow.io/hc/en-us/articles/26318139354909-Update-Critical-Snowplow-Security-Updates-Impact-on-Open-Source-Software-Users
CVE ID: CVE-2024-56529 State: PUBLISHED Published: 2025-01-28T00:00:00.000Z Last Updated: 2025-03-14T16:12:11.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mailcow through 2024-11b has a session fixation vulnerability in the web panel. It allows remote attackers to set a session identifier when HSTS is disabled on a victim's browser. After a user logs in, they are authenticated and the session identifier is valid. Then, a remote attacker can access the victim's web panel with the same session identifier. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-23c8-4wwr-g3c6
CVE ID: CVE-2024-56531 State: PUBLISHED Published: 2024-12-27T14:11:14.161Z Last Updated: 2025-11-03T20:49:10.948Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Use snd_card_free_when_closed() at disconnection The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup. An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately whi
An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately while the release of resources is done asynchronously by the card device release at the last close. This patch also splits the code to the disconnect and the free phases; the former is called immediately at the USB disconnect callback while the latter is called from the card destructor. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/3993edf44d3df7b6e8c753eac6ac8783473fcbab - https://git.kernel.org/stable/c/ebad462eec93b0f701dfe4de98990e7355283801 - https://git.kernel.org/stable/c/4dd821dcbfcecf7af6a0837
t.kernel.org/stable/c/ebad462eec93b0f701dfe4de98990e7355283801 - https://git.kernel.org/stable/c/4dd821dcbfcecf7af6a08370b0b217cde2818acf - https://git.kernel.org/stable/c/cadf1d8e9ddcd74584ec961aeac14ac549b261d8 - https://git.kernel.org/stable/c/237f3faf0177bdde728fa3106d730d806436aa4d - https://git.kernel.org/stable/c/4507a8b9b30344c5ddd8219945f446d47e966a6d - https://git.kernel.org/stable/c/dd0de8cb708951cebf727aa045e8242ba651bb52 - https://git.kernel.org/stable/c/a3f9314752dbb6f6aa1f0f2b4c58243bda800738 - https://git.kernel.org/stable/c/b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c
CVE ID: CVE-2024-56532 State: PUBLISHED Published: 2024-12-27T14:11:15.266Z Last Updated: 2025-11-03T20:49:13.727Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Use snd_card_free_when_closed() at disconnection The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup. An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately wh
. An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately while the release of resources is done asynchronously by the card device release at the last close. The loop of us122l->mmap_count check is dropped as well. The check is useless for the asynchronous operation with *_when_closed(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/020cbc4d7414f0962004213e2b7bc5cc607e9ec7 - https://git.kernel.org/stable/c/75f418b249d84021865eaa59515d3ed9b75ce4d6 - https://git.kernel.org/stable/c/bf0aa35a7cb8602cccf2387712114e836f65c154 - https://git.kernel.org/stable/c/9a48
5ce4d6 - https://git.kernel.org/stable/c/bf0aa35a7cb8602cccf2387712114e836f65c154 - https://git.kernel.org/stable/c/9a48bd2184b142c92a4e17eac074c61fcf975bc9 - https://git.kernel.org/stable/c/bc778ad3e495333eebda36fe91d5b2c93109cc16 - https://git.kernel.org/stable/c/2938dd2648522336133c151dd67bb9bf01cbd390 - https://git.kernel.org/stable/c/9b27924dc8d7f8a8c35e521287d4ccb9a006e597 - https://git.kernel.org/stable/c/9d5c530e4d70f64b1114f2cc29ac690ba7ac4a38 - https://git.kernel.org/stable/c/b7df09bb348016943f56b09dcaafe221e3f73947
CVE ID: CVE-2024-56533 State: PUBLISHED Published: 2024-12-27T14:11:16.256Z Last Updated: 2025-11-03T20:49:16.578Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: Use snd_card_free_when_closed() at disconnection The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup. An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately whi
An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately while the release of resources is done asynchronously by the card device release at the last close. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/24fe9f7ca83ec9acf765339054951f5cd9ae5c5d - https://git.kernel.org/stable/c/befcca1777525e37c659b4129d8ac7463b07ef67 - https://git.kernel.org/stable/c/7bd8838c0ea886679a32834fdcacab296d072fbe - https://git.kernel.org/stable/c/e07605d855c4104d981653146a330ea48f6266ed - https://git.kernel.org/stable/c/ffbfc6c4330fc233698529656798bee44fea96f5 - https://git.kernel
981653146a330ea48f6266ed - https://git.kernel.org/stable/c/ffbfc6c4330fc233698529656798bee44fea96f5 - https://git.kernel.org/stable/c/e869642a77a9b3b98b0ab2c8fec7af4385140909 - https://git.kernel.org/stable/c/dafb28f02be407e07a6f679e922a626592b481b0
CVE ID: CVE-2024-56534 State: PUBLISHED Published: 2024-12-27T14:11:17.091Z Last Updated: 2025-10-01T20:07:17.297Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: isofs: avoid memory leak in iocharset A memleak was found as below: unreferenced object 0xffff0000d10164d8 (size 8): comm "pool-udisksd", pid 108217, jiffies 4295408555 hex dump (first 8 bytes): 75 74 66 38 00 cc cc cc utf8.... backtrace (crc de430d31): [<ffff800081046e6c>] kmemleak_alloc+0xb8/0xc8 [<ffff8000803e6c3c>] __kmalloc_node_track_caller_noprof+0x380/0x474 [<ffff800080363b74>] kstrdup+0x70/0xfc [<ffff80007bb3c6a4>] isofs_parse_param+0x228/0x2c0 [isofs] [<ffff8
of+0x380/0x474 [<ffff800080363b74>] kstrdup+0x70/0xfc [<ffff80007bb3c6a4>] isofs_parse_param+0x228/0x2c0 [isofs] [<ffff8000804d7f68>] vfs_parse_fs_param+0xf4/0x164 [<ffff8000804d8064>] vfs_parse_fs_string+0x8c/0xd4 [<ffff8000804d815c>] vfs_parse_monolithic_sep+0xb0/0xfc [<ffff8000804d81d8>] generic_parse_monolithic+0x30/0x3c [<ffff8000804d8bfc>] parse_monolithic_mount_data+0x40/0x4c [<ffff8000804b6a64>] path_mount+0x6c4/0x9ec [<ffff8000804b6e38>] do_mount+0xac/0xc4 [<ffff8000804b7494>] __arm64_sys_mount+0x16c/0x2b0 [<ffff80008002b8dc>] invoke_syscall+0x7c/0x104 [<ffff80008002ba44>] el0_svc_common.constprop.1+0xe0/0x104 [<ffff80008002ba94>] do_el0_svc+0x2c/0x38 [<ffff800081041108>] el0_svc+0x
02ba44>] el0_svc_common.constprop.1+0xe0/0x104 [<ffff80008002ba94>] do_el0_svc+0x2c/0x38 [<ffff800081041108>] el0_svc+0x3c/0x1b8 The opt->iocharset is freed inside the isofs_fill_super function, But there may be situations where it's not possible to enter this function. For example, in the get_tree_bdev_flags function,when encountering the situation where "Can't mount, would change RO state," In such a case, isofs_fill_super will not have the opportunity to be called,which means that opt->iocharset will not have the chance to be freed,ultimately leading to a memory leak. Let's move the memory freeing of opt->iocharset into isofs_free_fc function. Additional Analyst Notes: - CISA ADP Vulnrich
t's move the memory freeing of opt->iocharset into isofs_free_fc function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/34f090ddb3630a26e5a6b220bf3bfaf5c7b70393 - https://git.kernel.org/stable/c/0fbab266ca8000333c966f5b58cb9b9cac658573 - https://git.kernel.org/stable/c/0b5bbeee4de616a268db77e2f40f19ab010a367b
CVE ID: CVE-2024-56535 State: PUBLISHED Published: 2024-12-27T14:11:18.174Z Last Updated: 2025-10-01T20:07:17.157Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg() kmalloc may fail, return value might be NULL and will cause NULL pointer dereference. Add check NULL return of kmalloc in btc_fw_set_monreg(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/051577414271961f3f4c3bff87b427924b486219 - https://git.kernel.org/stable/c/64db1a42d98307001a48cec1b3e68ce9f905e73d - https://git.kernel.org/stable/c/81df5ed446b4
https://git.kernel.org/stable/c/64db1a42d98307001a48cec1b3e68ce9f905e73d - https://git.kernel.org/stable/c/81df5ed446b448bdc327b7c7f0b50121fc1f4aa2
CVE ID: CVE-2024-56536 State: PUBLISHED Published: 2024-12-27T14:11:18.921Z Last Updated: 2025-10-01T20:07:17.027Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: cw1200: Fix potential NULL dereference A recent refactoring was identified by static analysis to cause a potential NULL dereference, fix this! Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0ec90ac5f7bd9dd573bd5d964cbdc3beaa93a33e - https://git.kernel.org/stable/c/67c914f2d64b28409796a6b9036c131e93f8af6c - https://git.kernel.org/stable/c/2b94751626a6d49bbe42a19cc1503bd391016bd5
CVE ID: CVE-2024-56537 State: PUBLISHED Published: 2024-12-27T14:11:19.743Z Last Updated: 2025-10-01T20:07:16.905Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm: xlnx: zynqmp_disp: layer may be null while releasing layer->info can be null if we have an error on the first layer in zynqmp_disp_create_layers Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ce7e62bbd55d20cf250396eb4e8f65b3b5a5e685 - https://git.kernel.org/stable/c/9218be402aeb1999cc119fc616e21c3cc7cdeec0 - https://git.kernel.org/stable/c/223842c7702b52846b1c5aef8aca7474ec1fd29b