223 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-11623
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security vulnerability has been detected in tmux up to 3.6a. Affected is the function imagefree of the file image.c. Such manipulation leads to use after free...
CVE-2026-47270
pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pamusb is a PAM module loaded into the host process sudo, login, GDM, GNOME Shell. Display managers such as GDM run multiple concurrent authentication threads. Three functions used by the denyremote...
CVE-2026-44713
pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/tmux.c reads the user's $TMUX environment variable, splits it on commas, and interpolates the socket-path component directly into a shell command passed to popen. Because the value is placed insi...
CVE-2026-44713
pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/tmux.c reads the user's $TMUX environment variable, splits it on commas, and interpolates the socket-path component directly into a shell command passed to popen. Because the value is placed insi...
CVE-2026-44713 pam_usb: Command injection via $TMUX environment variable leads to RCE as root
pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/tmux.c reads the user's $TMUX environment variable, splits it on commas, and interpolates the socket-path component directly into a shell command passed to popen. Because the value is placed insi...
CVE-2026-44713 pam_usb: Command injection via $TMUX environment variable leads to RCE as root
pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/tmux.c reads the user's $TMUX environment variable, splits it on commas, and interpolates the socket-path component directly into a shell command passed to popen. Because the value is placed insi...
EUVD-2026-32657
pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/tmux.c reads the user's $TMUX environment variable, splits it on commas, and interpolates the socket-path component directly into a shell command passed to popen. Because the value is placed insi...
CVE-2026-44713
Pam_usb vulnerability: in versions prior to 0.8.7, src/tmux.c reads the TMUX environment variable, splits on commas, and interpolates the socket-path directly into a shell command passed to popen(), placing the value inside double quotes without sanitisation. This allows an attacker-controlled va...
CVE-2026-47270
pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pamusb is a PAM module loaded into the host process sudo, login, GDM, GNOME Shell. Display managers such as GDM run multiple concurrent authentication threads. Three functions used by the denyremote...
CVE-2026-47270 pam_usb: strtok() race condition in multi-threaded PAM hosts can corrupt deny_remote result
pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pamusb is a PAM module loaded into the host process sudo, login, GDM, GNOME Shell. Display managers such as GDM run multiple concurrent authentication threads. Three functions used by the denyremote...
CVE-2026-47270 pam_usb: strtok() race condition in multi-threaded PAM hosts can corrupt deny_remote result
pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pamusb is a PAM module loaded into the host process sudo, login, GDM, GNOME Shell. Display managers such as GDM run multiple concurrent authentication threads. Three functions used by the denyremote...
pam_usb 安全漏洞
pamusb is a Linux hardware authentication tool developed by McDope’s individual developer, based on USB devices. Versions of pamusb prior to 0.8.7 contain security vulnerabilities. These vulnerabilities stem from the code in src/tmux.c, which reads the user’s $TMUX environment variable and insert...
JLSEC-2026-528
In tmux before version 3.1c the function inputcsidispatchsgrcolon in file input.c contained a stack-based buffer-overflow that can be exploited by terminal output...
PT-2026-47004
In tmux before version 3.1c the function input csi dispatch sgr colon in file input.c contained a stack-based buffer-overflow that can be exploited by terminal output...
tmux:cmd-parse-fuzzer: Heap-buffer-overflow in regsub
Project: https://github.com/tmux/tmux.git Detailed Report: https://oss-fuzz.com/testcase?key=5049488099311616 Project: tmux Fuzzing Engine: afl Fuzz Target: cmd-parse-fuzzer Job Type: aflasantmux Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7537a40e0480 Crash State:...
tmux:format-fuzzer: Heap-buffer-overflow in format_expand1
Project: https://github.com/tmux/tmux.git Detailed Report: https://oss-fuzz.com/testcase?key=5348870392709120 Project: tmux Fuzzing Engine: libFuzzer Fuzz Target: format-fuzzer Job Type: libfuzzerasantmux Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7ada289e1712 Cra...
tmux:input-fuzzer: Heap-double-free in paste_free
Project: https://github.com/tmux/tmux.git Detailed Report: https://oss-fuzz.com/testcase?key=4652877133185024 Project: tmux Fuzzing Engine: libFuzzer Fuzz Target: input-fuzzer Job Type: libfuzzerasantmux Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x7a33850e3b00 Crash State:...
tmux:input-fuzzer: Heap-use-after-free in input_reply_clipboard
Project: https://github.com/tmux/tmux.git Detailed Report: https://oss-fuzz.com/testcase?key=4616287904137216 Project: tmux Fuzzing Engine: libFuzzer Fuzz Target: input-fuzzer Job Type: libfuzzerasantmux Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash Address: 0x797ca51e6a40 Crash...
Arbitrary Command Injection
Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the interpolation of untrusted agent metadata into tmux shell command strings executed through /bin/sh -c. An attacker can execute arbitrary commands on the operator host by supplying crafted metadata...
Arbitrary Command Injection
Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the interpolation of untrusted agent metadata into tmux shell command strings executed through /bin/sh -c. An attacker can execute arbitrary commands on the operator host by supplying crafted metadata...