SUSE CVE-2017-5110

Inappropriate implementation of the web payments API on blob: and data: schemes in Web Payments in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page...

SUSE CVE-2017-5415

An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leading to user confusion and further spoofing attacks. This vulnerability affects Firefox 52...

SUSE CVE-2017-7814

File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files. This would allow malicious sites to lure users into downloading executables that would otherwise ...

SUSE CVE-2017-11524

The WriteBlob function in MagickCore/blob.c in ImageMagick before 6.9.8-10 and 7.x before 7.6.0-0 allows remote attackers to cause a denial of service assertion failure and application exit via a crafted file...

SUSE CVE-2017-15416

Heap buffer overflow in Blob API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka a Blink out-of-bounds read...

SUSE CVE-2018-5108

A Blob URL can violate origin attribute segregation, allowing it to be accessed from a private browsing tab and for data to be passed between the private browsing tab and a normal tab. This could allow for the leaking of private information specific to the private browsing context. This issue is...

SUSE CVE-2018-5142

If Media Capture and Streams API permission is requested from documents with "data:" or "blob:" URLs, the permission notifications do not properly display the originating domain. The notification states "Unknown protocol" as the requestee, leading to user confusion about which site is asking for...

SUSE CVE-2018-18345

Incorrect handling of blob URLS in Site Isolation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker who had compromised the renderer process to bypass site isolation protections via a crafted HTML page...

SUSE CVE-2019-9808

If WebRTC permission is requested from documents with data: or blob: URLs, the permission notifications do not properly display the originating domain. The notification states "Unknown origin" as the requestee, leading to user confusion about which site is asking for this permission. This...

SUSE CVE-2019-14980

In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file...

SUSE CVE-2021-23999

If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...

SUSE CVE-2022-36056

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

PT-2023-33940

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.87 Description The issue is related to the ksmbd decode ntlmssp auth blob function in the Linux Kernel, where the nt len is not properly checked to be at least CIFS ENCPWD SIZE. This could potentially lead ...

PT-2022-34939

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.0.6 Description A memory leak issue was discovered when building the NTLMSSP negotiate blob failed. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

kernel: brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path

In the Linux kernel, the following vulnerability has been resolved: brcmfmac: pcie: Release firmwares in the brcmfpciesetup error path This avoids leaking memory if brcmfchipgetraminfo fails. Note that the CLM blob is released in the device remove path...

Microsoft Confirms Server Misconfiguration Led to 65,000+ Companies' Data Leak

Microsoft this week confirmed that it inadvertently exposed information related to thousands of customers following a security lapse that left an endpoint publicly accessible over the internet sans any authentication. "This misconfiguration resulted in the potential for unauthenticated access to...

GSD-2022-1006605 netfilter: ebtables: fix memory leak when blob is malformed

netfilter: ebtables: fix memory leak when blob is malformed This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.260 by commit...

PT-2022-34861

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.260 Description A memory leak issue exists when a blob is malformed. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v4.19.260, update ...

PT-2022-34772

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.19.6 through v5.19.12 Description A memory leak issue exists when a blob is malformed. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions v5.19.6 through...

PT-2024-8459 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a memory leak in the netfilter component of the Linux kernel, specifically in the ebtables module when handling a malformed blob. The initial bug fix was...