CWE-401: Memory Leak vulnerabilities

CVE-2024-56729 is a vulnerability in the Linux kernel's SMB implementation where the cfid->tcon field is not initialized before network operations. This can cause a reference leak to the tcon object when a lease break races with opening a cached directory, potentially leading to resource exhaustion. The issue has been resolved by ensuring proper initialization of cfid->tcon before such operations.

CVE-2024-56712 is a low-severity vulnerability in the Linux kernel's udmabuf driver that causes a memory leak when the dma_buf_fd() call fails due to a full file descriptor table. The issue arises because the error handling does not properly release a dma_buf object, leaving a dangling pointer and leaked memory. This flaw does not impact confidentiality, integrity, or cause a crash, only leading to resource leakage.

CVE-2024-53178 is a high-severity vulnerability in the Linux kernel's SMB client implementation. It involves a reference count leak (cfid leak) caused by a race condition during SMB connection reconnection and directory caching operations. This flaw can lead to memory leaks and system instability, including BUG splats during SMB filesystem unmounts. The issue has been fixed by properly managing reference counts and lease flags on cached directory objects.

D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of D-Link DIR-3040 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the prog.cgi program, which handles HNAP requests made to the lighttpd webserver listening on ports 80 and 443. The issue results from the lack of proper memory management when processing HTTP cookie values. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. . Was ZDI-CAN-21668.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.12.54. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2024:1572 Security Fix(es): * golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394) * golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786) * jose-go: improper handling of highly compressed data (CVE-2024-28180) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html

CVE-2024-24259 is a high-severity memory leak vulnerability in freeglut up to version 3.4.0. The issue occurs in the glutAddMenuEntry function where the menuEntry variable is not properly released after its effective lifetime, leading to a resource leak.

BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file