Ecosystem
Azure Linux
13,280 known vulnerabilities.
Most affected packages
13,260 results · Feed
-
Low 3.1
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the conf…
-
Medium 4.3
An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to …
-
High 7.5
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which…
-
Medium 4.3
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentic…
-
Critical 9.1
An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free…
-
Medium 5.9
An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more th…
-
Low 3.1
None None None No publicly available exploits are known.
-
Low 3.7
When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes…
-
High 7.4
None None None No publicly available exploits are known.
-
Medium 6.5
An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal h…
-
Medium 4.3
An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid command…
-
Medium 6.5
An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disp…
-
Medium 4.3
An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an…
-
Medium 4.3
An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial o…
-
Medium 4.8
Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator…
-
High 7.5
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authent…
-
Medium 5.9
An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a …
-
Medium 4.3
When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused …
-
High 7.5
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email address…
-
High 8.8
wifi: mac80211: validate individual TWT params before driver setup
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate individual TWT params before driver setup ieee80211_process_rx_twt_action() only partially validates a received S1G TWT setup frame before queueing it. An individual …
-
High 8.8
Bluetooth: ISO: ensure no dangling hcon references in iso_conn
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in iso_conn After iso_conn_del(), ISO sockets should not dereference the hcon any more. Currently, clearing iso_conn::hcon relies on iso_con…
-
High 7.8
mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
In the Linux kernel, the following vulnerability has been resolved: mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() In pcpu_create_chunk(), nr_pages is the total contiguous backing allocation, i.e., nr_units * pcpu_unit_pages, but pcpu…
-
High 7.8
ALSA: pcm: wake linked drain waiters on unlink
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: wake linked drain waiters on unlink snd_pcm_drain() on a linked stream parks an on-stack wait entry on the drained peer's runtime->sleep, and after schedule_timeout() removes it on…
-
High 7.5
sctp: validate Adaptation Indication parameter length
In the Linux kernel, the following vulnerability has been resolved: sctp: validate Adaptation Indication parameter length The Adaptation Layer Indication parameter contains a fixed 32-bit Adaptation Code Point after its parameter header. However, sctp_verify_…
-
Unscored —
igc: remove napi_synchronize() in igc_down()
In the Linux kernel, the following vulnerability has been resolved: igc: remove napi_synchronize() in igc_down() When an AF_XDP zero-copy application is killed abruptly, the XSK pool is torn down but NAPI keeps polling. igc_clean_rx_irq_zc() then returns the …
-
Critical 9.8
ipvs: do not propagate one-packet flag to synced conns
In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ip_vs_bind_dest() copies connect…
-
High 7.8
s390/dasd: Fix undersized format-check buffer
In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix undersized format-check buffer fmt_buffer_size in dasd_eckd_check_device_format() is declared as int, even though one of the multiplicands, sizeof(struct eckd_count), is a size…
-
High 7.8
s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This chec…
-
High 7.5
can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
In the Linux kernel, the following vulnerability has been resolved: can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer Zero the allocated buffer in j1939_session_fresh_new() to ensure it contains no residual data. While there is a pot…
-
Unscored —
s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() The helper function _ip_cprb_helper() uses internal buffer memory for building and processing CPRBs. After use th…
-
High 7.8
can: softing: fw_parse(): validate firmware record spans
In the Linux kernel, the following vulnerability has been resolved: can: softing: fw_parse(): validate firmware record spans fw_parse() reads a fixed record header, a firmware-provided payload, and a trailing checksum without knowing the end of the firmware b…
-
Unscored —
drm/amd/display: use proper context for logging
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, get_ss_info_from_atombios() uses calc_pll_cs->ctx->logger for logging. But calc_pll_cs->ctx is initialized on…
-
Unscored —
drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE Prevent unauthorized termination of active GPU debug sessions. Previously, users with /dev/kfd access could terminate a…
-
High 7.8
drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size Two sites in vmwgfx_resource.c assign boolean literals to res->guest_memory_size, which is an unsigned long allocation-size field…
-
High 7.8
drm/vmwgfx: validate external BO copy bounds for both stride paths
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate external BO copy bounds for both stride paths vmw_external_bo_copy() trusts caller-supplied offsets, strides, and heights and operates on imported dma-buf vmaps: - The eq…
-
Unscored —
dmaengine: idxd: fix double free of wq, engine, and group structs
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix double free of wq, engine, and group structs The release callbacks for wq, engine, and group devices (idxd_conf_wq_release, idxd_conf_engine_release, idxd_conf_group_rele…
-
Unscored —
hwmon: (sht3x) Fix unaligned accesses
In the Linux kernel, the following vulnerability has been resolved: hwmon: (sht3x) Fix unaligned accesses Sashiko reports: In sht3x_update_client(), the 16-bit temperature and humidity values are extracted from a stack-allocated byte array using be16_to_cpup(…
-
Critical 9.8
net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller mtk_handle_irq_rx expects a struct mtk_eth * (matching the request_irq cookie), but mtk_poll_controller incorrectl…
-
High 8.8
Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that.
-
High 7.5
scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblock_execute_pr_out() function, PRO_PREEMPT, PRO_PREEMPT_AND_ABORT, and PRO_RELEASE all perform callback capabil…