Threats Tagged 'ubuntu-26-04-lts'

This update includes the following RPMs: openssl: * openssl-3.5.8-0.1.hum1 (aarch64, x86_64) * openssl-config-fips-3.5.8-0.1.hum1 (aarch64, x86_64) * openssl-devel-3.5.8-0.1.hum1 (aarch64, x86_64) * openssl-devel-engine-3.5.8-0.1.hum1 (aarch64, x86_64) * openssl-fips-provider-upstream-3.5.8-0.1.hum1 (aarch64, x86_64) * openssl-libs-3.5.8-0.1.hum1 (aarch64, x86_64) * openssl-perl-3.5.8-0.1.hum1 (aarch64, x86_64) * openssl-3.5.8-0.1.hum1.src (src)

QUIC Server May Trigger Double Free When Processing INITIAL Packet

Excessive Memory Use Buffering DTLS Records for a Future Epoch

Heap Buffer Overflow in CMS Key Unwrapping

CMP Indefinite Cache Growth of ExtraCerts

QUIC ACK-only Packet Retention Can Cause Memory Exhaustion

Invalid Pointer Dereference in CMP Server via Crafted protectionAlg

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix overrun check in netfs_extract_user_iter() Fix netfs_extract_user_iter() so that if iov_iter_extract_pages() overfills pages[], then those pages don't get included in the iterator constructed at the end of the function. If there was an overfill, memory corruption has already happened.

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free of pool->stack on AQ init failure otx2_pool_aq_init() frees pool->stack when mailbox sync or retry allocation fails, but leaves the pointer unchanged. Later, otx2_sq_aura_pool_init() unwinds the partial setup through otx2_aura_pool_free(), which frees pool->stack again. The CN20K-specific cn20k_pool_aq_init() implementation has the same bug in its corresponding error path. Set pool->stack to NULL immediately after the local free so the shared cleanup path does not free the same stack again while cleaning up partially initialized pool state. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc3. Runtime validation was not performed because reproducing this path requires OcteonTX2/CN20K hardware.

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: don't dump registers past the mapped region On DSI 6G platforms the IO address space is internally adjusted by io_offset. Later this adjusted address might be used for memory dumping. However the size that is used for memory dumping isn't adjusted to account for the io_offset, leading to the potential access to the unmapped region. Lower ctrl_size by the io_offset value to prevent access past the mapped area. msm_disp_snapshot_add_block+0x1d4/0x3c8 [msm] (P) msm_dsi_host_snapshot+0x4c/0x78 [msm] msm_dsi_snapshot+0x28/0x50 [msm] msm_disp_snapshot_capture_state+0x74/0x140 [msm] msm_disp_snapshot_state_sync+0x60/0x90 [msm] _msm_disp_snapshot_work+0x30/0x90 [msm] kthread_worker_fn+0xdc/0x460 kthread+0x120/0x140 Patchwork: https://patchwork.freedesktop.org/patch/721747/