MINI-FM97-FPC2-2327

Bulletin has no description...

ECHO-2327-9760-E268 Claimed out-of-bounds write in dlx_rtype_to_howto() (bfd/elf32-dlx.c), reached from elf32_dlx_info_to_howto_rel() via the relocation type of a crafted ELF/DLX object. The DLX backend is not built. dlx_elf32_be_vec is selected only by the dlx-*-elf target triple (bfd/config.bfd), and that vec is the sole trigger for compiling elf32-dlx.lo (bfd/configure.ac); debian/rules passes an explicit per-architecture --enable-targets list and never --enable-targets=all. Verified against the shipped amd64 and arm64 debs: libbfd exports no dlx symbols, `objdump -b elf32-dlx` returns "invalid bfd target", `ld -m elf32dlx` is an unrecognised emulation, and a crafted EM_DLX (0x5aa5) object carrying relocation types past the end of the howto table is claimed by the generic elf32-big backend, which reports "architecture: UNKNOWN!" and every relocation as UNKNOWN. The function is never entered. Note that readelf prints DLX machine and relocation names from its own tables, independent of BFD, so its output is not evidence of the backend being present. Upstream also rejects the finding on its merits, even with DLX enabled. On the Red Hat bug that Debian's tracker carries as its only reference, maintainer Andrew Burgess concludes "I don't believe that this is actually a bug": DLX relocation types are a contiguous 0-9, not the non-contiguous space with extended types at 0x10000+ that the advisory describes; dlx_rtype_to_howto() already rejects r_type >= R_DLX_max (10); and types 6-9 have their own case arms, so the indexed access can only ever reach 0-5 of the 6-entry dlx_elf_howto_table. Patrick Monnerat adds that the advisory claims an out-of-bounds write while the procedure performs no indexed write at all. Both observations hold against the 2.45.50.20251201 source. Debian marks it unimportant (binutils not covered by security support) and ships no fix in any suite including forky/sid, so there is nothing to bump.

Bulletin has no description...

MINI-4W4V-2327-V5RX

Bulletin has no description...

MINI-2327-W724-448F

Bulletin has no description...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in Node.js

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in Node.js. CVE-2026-32141, CVE-2026-0540, CVE-2026-2327, CVE-2026-27903, CVE-2026-27904. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-3214...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationServer and IntegrationRuntime operands are vulnerable to denial of service (CVE-2026-2327)

Summary Node.js module markdown-it is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationServer and IntegrationRuntime operands are vulnerable to regular expression denial of service ReDoS. This bulletin provides...

CVE-2026-2327 vulnerabilities

Vulnerabilities for packages: vitess, kibana, renovate, semaphore...

CVE-2026-2327

A flaw was found in markdown-it. A remote attacker can exploit this Regular Expression Denial of Service ReDoS vulnerability by providing a specially crafted input containing a long sequence of asterisk characters followed by a non-matching character to the linkify function. This triggers excessi...

CVE-2026-2327

The CVE-2026-2327 case concerns the markdown-it package. Affected versions: 13.0.0 through 14.1.0 (and up to 14.1.1 as fixed) are vulnerable to a Regular Expression Denial of Service in the linkify function due to the regex /*$/ used for links; an attacker can provide a long sequence of * follow...

MiracleLinux 3 : libtiff-3.8.2-7.2 (AXSA:2008-91:01)

The remote MiracleLinux 3 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2008-91:01 advisory. The libtiff package contains a library of functions for manipulating TIFF Tagged Image File Format image format files. TIFF is a widely used file format for...

EUVD-2026-2327

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid unregistering PSP twice PSP is unregistered twice in: mlx5eremove - mlx5epspunregister mlx5eniccleanup - mlx5epspunregister This leads to a refcount underflow in some conditions: ------------ cut here -----------...

CVE-2022-2327 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-qemu, linux-qemu-melange...

Linux Distros Unpatched Vulnerability : CVE-2022-2327

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring use workflags to determine which identity need to grab from the calling process to make sure it is consistent with the calling process when executing...

CVE-2025-2327

creationtimestamp| type| source ---|---|--- 2025-06-16 16:36:00+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18467 2025-06-16 16:37:19+00:00| seen| https://bsky.app/profile/potato.software/post/3lrqg3a3wu225 2025-06-16 17:25:41+00:00| seen|...

CVE-2010-2327

modibmssl in IBM HTTP Server 6.0 before 6.0.2.43, 6.1 before 6.1.0.33, and 7.0 before 7.0.0.11, as used in IBM WebSphere Application Server WAS on z/OS, does not properly handle a large HTTP request body in uploading over SSL, which might allow remote attackers to cause a denial of service daemon...

Linux Distros Unpatched Vulnerability : CVE-2015-2327

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PCRE before 8.36 mishandles the /a\2|a\g/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a...

Siemens SIMATIC Devices Linux Kernel Double Free (CVE-2022-2327)

iouring use workflags to determine which identity need to grab from the calling process to make sure it is consistent with the calling process when executing IORINGOP. Some operations are missing some types, which can lead to incorrect reference counts which can then lead to a double free. We...

CVE-2022-2327

iouring use workflags to determine which identity need to grab from the calling process to make sure it is consistent with the calling process when executing IORINGOP. Some operations are missing some types, which can lead to incorrect reference counts which can then lead to a double free. We...

WordPress Global Elementor Buttons Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Global Elementor Buttons Type Plugin Vulnerable versions = 1.1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2327 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9b77cf7f4448 Credits Francesco Carlucc...

openSUSE: Security Advisory for curl (SUSE-SU-2022:2327-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...