The internet is broken right now.

In codec3p_secure of codec3p_secure, there is a possible Heap Buffer Overflow due to a missing bounds check. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Memory safety OS & kernel

In edgetpu_group_clear_responses of edgetpu_group.c, there is a possible Use After Free due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Memory safety OS & kernel

In PresenceDecoderV1::DecodeDataElements of presence_decoder_v1.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Memory safety OS & kernel

In EncodeLastScanBufferElement of data_manager.cc, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Memory safety OS & kernel

In port_shutdown of ipc.c, there is a possible Use After Free due to a race condition. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Memory safety OS & kernel

In smmu_detach_dev of private/google-modules/iommu/arm-smmu-v3/drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c, there is a possible Use After Free due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

Memory safety OS & kernel

In handle_fips_hmac_req of hwcrypto_proxy.c, there is a possible heap buffer overflow due to missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Memory safety OS & kernel

In RecordApTx of efw_ap_transport.c, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Memory safety OS & kernel

In insert_node of remap.c, there is a possible way to trigger an out of bounds write in the address remapping table due to a non-heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Memory safety OS & kernel

In parse_prime256v1 of keymint_asn1.c, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Memory safety OS & kernel

In TzSharedMemory of TzSharedMemory.c, there is a possible Heap buffer overflow due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Memory safety OS & kernel

Stack-based Buffer Overflow in the ACPI event handler of the QVM could allow an attacker in a guest to crash the QVM by sending a crafted ACPI request.

Memory safety OS & kernel

Invalid Memory Access via the MSI-X table in QVM could allow an attacker in the guest to execute arbitrary code in the QVM to cause memory corruption, information disclosure or a crash of the QVM.

Memory safety OS & kernel

Out-Of-Bounds Read in the MSI-X table in the QVM could allow an attacker in the guest to cause an information disclosure or a crash of the QVM.

Memory safety OS & kernel

On affected platforms running Arista EOS with Bidirectional Forwarding Detection (BFD) configured to use keyed MD5 or keyed SHA1 authentication, an unauthenticated attacker with network adjacency (direct or multi-hop) to a BFD-enabled interface can send a specially crafted BFD packet resulting in a system reboot.

Memory safety

On affected EOS-based platforms, an attacker who controls a Border Gateway Protocol (BGP) peer can send a crafted BGP message over an established session with the Dynamic Path Selection (DPS) address family negotiated. This can cause the BGP process to terminate unexpectedly, resetting all BGP sessions and disrupting routing services until the process restarts.

Memory safety

On affected platforms running Arista EOS with BGP configured, a specially crafted packet can cause the BGP agent to crash. Successful exploitation causes the BGP agent process to terminate, resulting in the loss of all BGP sessions on the affected device and possible disruption to network routing until the process recovers. Due to the nature of the vulnerability, it may also be possible for a sophisticated attacker to achieve arbitrary code execution, which could compromise the confidentiality and integrity of the affected system.

Memory safety

A malformed Error Report can cause EOS to read beyond packet boundaries, potentially terminating the RPKI agent or exposing unintended memory contents through logging.

Memory safety

On affected platforms running Arista EOS in multi-agent routing model with BGP Segment Routing Traffic Engineering (SR-TE) address family configured, a BGP peer can send crafted BGP packets to cause the BGP process to restart, disrupting all BGP sessions on the device.

Memory safety

On affected Arista EOS platforms running Border Gateway Protocol with Link State ( BGP-LS) and configured with the Dynamic Path Selection (DPS) consumer role, an attacker who has established an authenticated BGP-LS session with the device can send a crafted message to cause the BGP agent to restart unexpectedly. An Arista Pathfinder deployment is not required.

Memory safety

A use-after-free read issue exists in MongoDB’s SBE (Slot-Based Execution) engine when processing aggregation pipelines with $unwind on time-series collections. An internal error in state-preservation logic can cause a value still referenced by downstream stages to have its underlying memory freed prematurely. An authenticated user can craft an aggregation pipeline under specific conditions to trigger this condition, potentially reading recycled server heap memory in query results or crashing the server. This issue is only triggerable when a non-default server parameter related to the SBE engine is enabled.

Memory safety Server

A use-after-free issue exists in the MongoDB server’s classic query engine plan cache. Under certain query conditions, an unowned reference to data from an earlier command can be retained in cached plan statistics. After the originating memory is freed, a subsequent diagnostic command serializing those statistics can read freed heap memory, potentially returning sensitive server process memory contents to the authenticated client. Under certain heap reuse conditions, this may also cause the server to crash.

Memory safety Server

A use-after-free issue exists in MongoDB’s SBE (Slot-Based Execution) implementation of a window function accumulator used by certain $setWindowFields aggregation pipelines. Under specific conditions, the accumulator can retain a dangling pointer to memory that has since been freed. When this stale pointer is later dereferenced during serialization of the carried-forward value, it can result in a heap out-of-bounds read that may expose adjacent heap contents and crash the mongod server. An authenticated user with readWrite privileges on a database can trigger this issue by crafting a specific aggregation pipeline.

Memory safety Server

Out-of-bounds read in Windows VMSwitch allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel

Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.

Memory safety OS & kernel

Access of resource using incompatible type ('type confusion') in Windows Shell allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel

Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

Memory safety OS & kernel

Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.

Memory safety OS & kernel

Out-of-bounds read in Secondary Logon allows an authorized attacker to disclose information locally.

Memory safety OS & kernel

Use after free in Windows PCI Bus Driver allows an unauthorized attacker to elevate privileges with a physical attack.

Memory safety OS & kernel

Use after free in Winsock allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel

Null pointer dereference in Windows USM Communication Manager allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel

Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.

Memory safety OS & kernel

Use after free in Windows DNS allows an unauthorized attacker to deny service over an adjacent network.

Memory safety OS & kernel

Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.

Memory safety OS & kernel

Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.

Memory safety OS & kernel

Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.

Memory safety OS & kernel

Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.

Memory safety OS & kernel

Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel

Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.

Memory safety OS & kernel

Use after free in Windows Credential User Interface allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel

Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.

Memory safety OS & kernel

Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.

Memory safety OS & kernel

Out-of-bounds write in Windows PCI Bus Driver allows an unauthorized attacker to elevate privileges with a physical attack.

Memory safety OS & kernel

Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.

Memory safety OS & kernel

Use after free in Windows NetBIOS allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel

Out-of-bounds read in Windows DNS allows an unauthorized attacker to disclose information over a network.

Memory safety OS & kernel

Use after free in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel

Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.

Memory safety OS & kernel

Use after free in DNS Server allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel