PulseLinuxLINUX UPDATE INTELLIGENCE

CVE 2022 document archive · 49

Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →

3,646 documents · Identifier year 2022 · 49 / 73

  1. CVE-2022-39348python-twisted: NameVirtualHost Host header injection
  2. CVE-2022-39347freerdp: missing path sanitation with `drive` channel
  3. CVE-2022-39328grafana: race condition allowing privilege escalation
  4. CVE-2022-39324grafana: Spoofing of the originalUrl parameter of snapshots
  5. CVE-2022-39320freerdp: heap buffer overflow in urbdrc channel
  6. CVE-2022-39319freerdp: missing length validation in urbdrc channel
  7. CVE-2022-39318freerdp: division by zero in urbdrc channel
  8. CVE-2022-39317freerdp: undefined behaviour in zgfx decoder
  9. CVE-2022-39316freerdp: out of bounds read in zgfx decoder
  10. CVE-2022-39307grafana: User enumeration via forget password
  11. CVE-2022-39306grafana: email addresses and usernames cannot be trusted
  12. CVE-2022-39283freerdp: clients using the `/video` command line switch might read uninitialized data
  13. CVE-2022-39282freerdp: clients using `/parallel` command line switch might read uninitialized data
  14. CVE-2022-39260git: git shell function that splits command arguments can lead to arbitrary heap writes.
  15. CVE-2022-39253git: exposure of sensitive information to a malicious actor
  16. CVE-2022-39251Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack
  17. CVE-2022-39250Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a device verification attack
  18. CVE-2022-39249Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack by malicious server administrators
  19. CVE-2022-39236Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a data corruption issue
  20. CVE-2022-39229grafana: using email as a username can block other users from signing in
  21. CVE-2022-39227python-jwt: token forgery with new claims
  22. CVE-2022-39201grafana: Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins
  23. CVE-2022-39190kernel: nf_tables disallow binding to already bound chain
  24. CVE-2022-39189kernel: TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning
  25. CVE-2022-39188kernel: unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry
  26. CVE-2022-39177bluez: BlueZ allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in profiles/audio/avdtp.c
  27. CVE-2022-39176bluez: BlueZ allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len
  28. CVE-2022-39170libdwarf: double free in _dwarf_exec_frame_instr() in dwarf_frame.c
  29. CVE-2022-39046glibc: a crafted input may allow information disclosure
  30. CVE-2022-38900decode-uri-component: improper input validation resulting in DoS
  31. CVE-2022-38791mariadb: compress_write() fails to release mutex on failure
  32. CVE-2022-38784poppler: integer overflow in JBIG2 decoder using malformed files
  33. CVE-2022-38752snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode
  34. CVE-2022-38751snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match
  35. CVE-2022-38750snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject
  36. CVE-2022-38749snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode
  37. CVE-2022-38745libreoffice: Empty entry in Java class path
  38. CVE-2022-38533binutils: heap-based buffer overflow in bfd_getl32() when called by strip_main() in objcopy.c via a crafted file
  39. CVE-2022-38478Mozilla: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and Firefox ESR 91.13
  40. CVE-2022-38477Mozilla: Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
  41. CVE-2022-38476Mozilla: Data race and potential use-after-free in PK11_ChangePW
  42. CVE-2022-38473Mozilla: Cross-origin XSLT Documents would have inherited the parent's permissions
  43. CVE-2022-38472Mozilla: Address bar spoofing via XSLT error handling
  44. CVE-2022-38457kernel: vmwgfx: use-after-free in vmw_cmd_res_check
  45. CVE-2022-38349poppler: Reachable assertion in Object.h
  46. CVE-2022-38266leptonica: arithmetic exception leads to denial of service
  47. CVE-2022-38178bind: memory leaks in EdDSA DNSSEC verification code
  48. CVE-2022-38177bind: memory leak in ECDSA DNSSEC verification code
  49. CVE-2022-38150varnish: denial of service via colon-starting reason phrase
  50. CVE-2022-38096kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query
CVE 2022 document archive — Page 49 | PulseLinux