| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Use of uninitialized resource in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
| Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
| In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
snd_seq_event_dup() copies an incoming event into a pool cell and, in
the UMP-enabled build, clears the trailing cell->ump.raw.extra word that
the memcpy() did not cover. The guard deciding whether to clear it
compares the copied size against sizeof(cell->event):
memcpy(&cell->ump, event, size);
if (size < sizeof(cell->event))
cell->ump.raw.extra = 0;
For a legacy (non-UMP) event, size == sizeof(struct snd_seq_event) ==
sizeof(cell->event), so the condition is false and the extra word keeps
stale data. The cell pool is allocated with kvmalloc() (not zeroed) and
cells are reused via a free list, so that word holds uninitialised heap
or leftover event data.
When such a cell is delivered to a UMP client (client->midi_version > 0)
that set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it
unconverted -- snd_seq_read() reads it out as the larger struct
snd_seq_ump_event and copies the stale word to user space, a 4-byte
kernel heap infoleak to an unprivileged /dev/snd/seq client.
Compare against sizeof(cell->ump) instead, so the trailing word is zeroed
for every event shorter than the UMP cell. |
| A improper neutralization of special elements used in an ldap query ('ldap injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to bypass authentication. Successful exploitation requires either a malicious/compromised upstream IdP, or an IdP configuration that allows the user to control the NameID (or the SAML attribute used as the username). |
| Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
| Use of uninitialized resource in Windows Broker Infrastructure Service allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Windows Text Services Framework allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
| Use of uninitialized resource in Microsoft ActiveX Installer Service allows an authorized attacker to elevate privileges locally. |
| Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information locally. |
| In the Linux kernel, the following vulnerability has been resolved:
net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()
The transmit loop in airoha_dev_xmit() reads fragment address and length
during its final iteration, when the loop index equals
skb_shinfo(skb)->nr_frags, at which point the fragment data is
uninitialized. While these values are never consumed, the read itself is
unsafe and may trigger a page fault. Fix this by avoiding the fragment
read on the last iteration.
Additionally, move the skb pointer from the first to the last used packet
descriptor, so that airoha_qdma_tx_napi_poll() defers freeing the skb
until the final descriptor is processed. |
| Use of uninitialized resource in Windows NTFS allows an authorized attacker to elevate privileges locally. |
| Use of uninitialized resource in Windows Installer allows an unauthorized attacker to disclose information over a network. |
| Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. |
| Use of uninitialized resource in Windows Smart Card allows an authorized attacker to elevate privileges with a physical attack. |
