CVE-2022-35009

PNGDec commit 8abf6be was discovered to contain a memory allocation problem via asanmalloclinux.cpp...

UBUNTU-CVE-2025-37880

In the Linux kernel, the following vulnerability has been resolved: um: work around schedyield not yielding in time-travel mode schedyield by a userspace may not actually cause scheduling in time-travel mode as no time has passed. In the case seen it appears to be a badly implemented userspace...

CVE-2025-37880 um: work around sched_yield not yielding in time-travel mode

In the Linux kernel, the following vulnerability has been resolved: um: work around schedyield not yielding in time-travel mode schedyield by a userspace may not actually cause scheduling in time-travel mode as no time has passed. In the case seen it appears to be a badly implemented userspace...

libxslt xsltParseStylesheetProcess Use-After-Free

libxslt suffers from a use-after-free vulnerability in xsltParseStylesheetProcess. There is a use-after-free issue in libxslt read on a namespace URL stored in exclPrefixTab. The issue was reproduced on the latest Git version. The proof of concept and ASAN log are provided at the end of the repor...

Linux watch_queue Filter Out-Of-Bounds Write

The Linux watchqueue filter suffers from an out of bounds write vulnerability amongst other issues that are also noted. This bug report is about things in the watchqueue subsystem, which is only enabled under CONFIGWATCHQUEUE. That seems to be disabled e.g. on Debian, but Ubuntu and Fedora enable...

Exploit for Out-of-bounds Write in Facebook Netconsd

CVE-2023-28753 An integer overflow vulnerability tha...

CVE-2024-38440

Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation violation, because of incorrectly using FPLoginExt in BNbin2bn in etc/uams/uamsdhxpam.c. The original issue 1097 report stated: 'The latest version of Netatalk v3.2.0 contains a security...

BIT-TENSORFLOW-2022-29210 Heap buffer overflow due to incorrect hash function in TensorFlow

TensorFlow is an open source platform for machine learning. In version 2.8.0, the TensorKey hash function used total estimated AllocatedBytes, which a is an estimate per tensor, and b is a very poor hash function for constants e.g. int32t. It also tried to access individual tensor bytes through...

Stable Channel Update for Desktop

The Stable channel has been updated to 121.0.6167.85 for Mac and Linux and 121.0.6167.85/.86 to Windows which will roll out over the coming days/weeks. A full list of changes in this build is available in the log. Security Fixes and Rewards Note: Access to bug details and links may be kept...

ASB-A-168903843

In ippSetValueTag of ipp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure of past print jobs or other print-related information, with no additional execution privileges needed. User interaction is not needed for exploitation...

heap-buffer-overflow in /radare2/shlr/java/code.c:211:21 in java_print_opcode

Description heap-buffer-overflow in /radare2/shlr/java/code.c:211:21 in javaprintopcode Version $ r2 -v radare2 5.8.9 31339 @ linux-x86-64 birth: git.5.8.8-691-gb2de2288d8 2023-10-1701:18:28 commit: b2de2288d8299f89288c503fc2ce22381b61aba0 Platform $ uname -a Linux user-GE40-2PC-Dragon-Eyes...

memcpy-param-overlap in MP4Box

Description memcpy-param-overlap in MP4Box Version $ ./MP4Box -version MP4Box - GPAC version 2.3-DEV-rev566-g50c2ab06f-master Platform $ uname -a Linux user-GE40-2PC-Dragon-Eyes 6.2.0-33-generic 3322.04.1-Ubuntu SMP PREEMPTDYNAMIC Thu Sep 7 10:33:52 UTC 2 x8664 x8664 x8664 GNU/Linux Asan 32mDashe...

Out of Bounds Read in scene_manager/loader_bt.c:478

Description Out of Bounds Read in MP4Box. Version $ ./bin/gcc/MP4Box -version MP4Box - GPAC version 2.3-DEV-revrelease c 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io Please cite our work in your research: GPAC Filters: https://doi.org/10.1145/3339825.3394929 GPAC:...

heap-buffer-overflow in function swf_def_font scene_manager/swf_parse.c:1449

Description Heap-buffer-overflow in MP4Box. Version $ ./bin/gcc/MP4Box -version MP4Box - GPAC version 2.3-DEV-revrelease c 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io Please cite our work in your research: GPAC Filters: https://doi.org/10.1145/3339825.3394929 GPAC:...

heap-use-after-free in mp4_mux_process_fragmented filters/mux_isom.c:6634

Description heap-use-after-free in MP4Box. Version $ ./bin/gcc/MP4Box -version MP4Box - GPAC version 2.3-DEV-revrelease c 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io Please cite our work in your research: GPAC Filters: https://doi.org/10.1145/3339825.3394929 GPAC:...

left shift of negative value in scene_manager/swf_parse.c:213:12

Description left shift of negative value in MP4Box Version $ ./bin/gcc/MP4Box -version MP4Box - GPAC version 2.3-DEV-revrelease c 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io Please cite our work in your research: GPAC Filters: https://doi.org/10.1145/3339825.3394929 GPAC...

Out of Bounds Read in MPEG12_ParseSeqHdr media_tools/mpeg2_ps.c

Description Out of Bounds Read in MP4Box. Version $ ./bin/gcc/MP4Box -version MP4Box - GPAC version 2.3-DEV-revrelease c 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io Please cite our work in your research: GPAC Filters: https://doi.org/10.1145/3339825.3394929 GPAC:...

Use After Free in gf_filterpacket_del filter_core/filter.c:38

Description Use After Free in MP4Box. I'm not sure if this is a bug or an exploitable vulnerability. Since it was a double-free crash, I classified it as a UAF vulnerability type. Version $ ./bin/gcc/MP4Box -version MP4Box - GPAC version 2.3-DEV-revrelease c 2000-2023 Telecom Paris distributed...

Fedora 38 : opensc (2023-29530cc60b)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-29530cc60b advisory. Fix buffer overrun vulnerability 2211088, fixes CVE-2023-2977 Tenable has extracted the preceding description block directly from the Fedora securit...

Fedora 37 : opensc (2023-2afb831742)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-2afb831742 advisory. Fix buffer overrun vulnerability 2211088, fixes CVE-2023-2977 Tenable has extracted the preceding description block directly from the Fedora securit...