Filtered by vendor Fedoraproject Subscriptions
Filtered by product Fedora Subscriptions
Total 5205 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-2011 2 Fedoraproject, Google 2 Fedora, Chrome 2024-11-21 8.8 High
Use after free in ANGLE in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2022-2010 2 Fedoraproject, Google 2 Fedora, Chrome 2024-11-21 9.3 Critical
Out of bounds read in compositing in Google Chrome prior to 102.0.5005.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVE-2022-2008 2 Fedoraproject, Google 2 Fedora, Chrome 2024-11-21 8.8 High
Double free in WebGL in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2022-2007 2 Fedoraproject, Google 2 Fedora, Chrome 2024-11-21 8.8 High
Use after free in WebGPU in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2022-2000 4 Apple, Debian, Fedoraproject and 1 more 4 Macos, Debian Linux, Fedora and 1 more 2024-11-21 7.8 High
Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
CVE-2022-29968 3 Fedoraproject, Linux, Netapp 13 Fedora, Linux Kernel, H300s and 10 more 2024-11-21 7.8 High
An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in fs/io_uring.c lacks initialization of kiocb->private.
CVE-2022-29901 6 Debian, Fedoraproject, Intel and 3 more 258 Debian Linux, Fedora, Core I3-6100 and 255 more 2024-11-21 5.6 Medium
Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.
CVE-2022-29900 5 Amd, Debian, Fedoraproject and 2 more 253 A10-9600p, A10-9600p Firmware, A10-9630p and 250 more 2024-11-21 6.5 Medium
Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions.
CVE-2022-29869 3 Debian, Fedoraproject, Samba 3 Debian Linux, Fedora, Cifs-utils 2024-11-21 5.3 Medium
cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file.
CVE-2022-29824 6 Debian, Fedoraproject, Netapp and 3 more 26 Debian Linux, Fedora, Active Iq Unified Manager and 23 more 2024-11-21 6.5 Medium
In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.
CVE-2022-29536 3 Debian, Fedoraproject, Gnome 3 Debian Linux, Fedora, Epiphany 2024-11-21 7.5 High
In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long page title. The issue occurs because the number of bytes for a UTF-8 ellipsis character is not properly considered.
CVE-2022-29526 5 Fedoraproject, Golang, Linux and 2 more 15 Fedora, Go, Linux Kernel and 12 more 2024-11-21 5.3 Medium
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.
CVE-2022-29502 2 Fedoraproject, Schedmd 2 Fedora, Slurm 2024-11-21 9.8 Critical
SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges.
CVE-2022-29501 3 Debian, Fedoraproject, Schedmd 3 Debian Linux, Fedora, Slurm 2024-11-21 8.8 High
SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges and code execution.
CVE-2022-29500 3 Debian, Fedoraproject, Schedmd 3 Debian Linux, Fedora, Slurm 2024-11-21 8.8 High
SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure.
CVE-2022-29404 4 Apache, Fedoraproject, Netapp and 1 more 5 Http Server, Fedora, Clustered Data Ontap and 2 more 2024-11-21 7.5 High
In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.
CVE-2022-29221 3 Debian, Fedoraproject, Smarty 3 Debian Linux, Fedora, Smarty 2024-11-21 8.8 High
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.
CVE-2022-29217 2 Fedoraproject, Pyjwt Project 2 Fedora, Pyjwt 2024-11-21 7.4 High
PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can specify `jwt.algorithms.get_default_algorithms()` to get support for all algorithms, or specify a single algorithm. The issue is not that big as `algorithms=jwt.algorithms.get_default_algorithms()` has to be used. Users should upgrade to v2.4.0 to receive a patch for this issue. As a workaround, always be explicit with the algorithms that are accepted and expected when decoding.
CVE-2022-29187 5 Apple, Debian, Fedoraproject and 2 more 6 Xcode, Debian Linux, Fedora and 3 more 2024-11-21 7.8 High
Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported in CVE-2022-24765, for example when navigating as root into a shared tmp directory that is owned by them, but where an attacker could create a git repository. Versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 contain a patch for this issue. The simplest way to avoid being affected by the exploit described in the example is to avoid running git as root (or an Administrator in Windows), and if needed to reduce its use to a minimum. While a generic workaround is not possible, a system could be hardened from the exploit described in the example by removing any such repository if it exists already and creating one as root to block any future attacks.
CVE-2022-29162 3 Fedoraproject, Linuxfoundation, Redhat 4 Fedora, Runc, Enterprise Linux and 1 more 2024-11-21 5.9 Medium
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.