MariaDB Server buffer error vulnerability

MariaDB Server versions from 10.6.1 to 10.6.28, 10.11.1 to 10.11.19, 11.4.1 to 11.4.13, 11.8.1 to 11.8.9, 12.3.1 to 12.3.3, and 13.0.1 to 13.0.2 have a buffer error vulnerability. This vulnerability arises from STArea, which processes invalid WKBs for MultiPolygon. The polygon parser does not...

Red Hat Enterprise Linux buffer error vulnerability

Red Hat Enterprise Linux versions 7, 8, 9, and 10 have a buffer overflow vulnerability. This vulnerability stems from the libparted library’s handling of file system resizing logic for FAT16 volumes. The exploit involves exploiting a heap-based buffer overflow by tricking users or administrators...

MariaDB Server buffer error vulnerability

MariaDB Server versions prior to 10.6.1 and 10.6.28, 10.11.1 and 10.11.19, 11.4.1 and 11.4.13, 11.8.1 and 11.8.9, 12.3.1 and 12.3.3, and 13.0.1 and 13.0.2 have a buffer error vulnerability. This vulnerability arises from STAsText, when converting deeply nested GeometryCollections, where recursive...

Lenovo Energy Management Driver buffer error vulnerability

Versions of the Lenovo Energy Management Driver prior to 15.11.30.14 contain a buffer error vulnerability. This vulnerability stems from out-of-bounds writes, which may cause blue-screen errors for locally authenticated users...

WEINVEIW EBProv Security Vulnerability

Weinveiw EBProv v.6.10.01.51020251022 has a security vulnerability. This vulnerability stems from a buffer overflow in the UtilityManagerEx.exe component, which could allow a remote attacker to execute arbitrary code...

Latchset LUKSMeta buffer error vulnerability

The LATCHSET LUKSMeta exists buffer error vulnerability stems from luksmeta’s improper boundary verification of metadata slots. Attackers can redirect erasure or loading operations outside the intended metadata area by providing or modifying disk heads. This allows them to overwrite or clear...

Freedesktop spice-server numerical error vulnerability

The Freedesktop spice-server has a numerical error vulnerability. This vulnerability stems from the GLZ encoder dictionary recovery path truncating the sizet allocation size to an int when calling the malloc callback. This could allow authenticated malicious SPICE clients to trigger a large-scale...

Alexandre Dulaunoy ssldump buffer error vulnerability

Alexandre Dulaunoy’s ssldump 1.9.0 and earlier versions contain a buffer error vulnerability. This vulnerability stems from an error in the calculation of the heap buffer allocation size by the fanxfingerprint function in ssl/sslxprint.c when formatting FAN/X.509 certificate fingerprints...

FreeRDP buffer error vulnerability

Versions of FreeRDP prior to 3.32.0 have a buffer error vulnerability. This vulnerability stems from a heap buffer overflow in the persistentcachereadentryv3 function. An attacker can provide a specially crafted v3 persistent cache file. Setting larger width and height values causes the size...

FreeRDP buffer error vulnerability

Versions of FreeRDP prior to 3.32.0 have a buffer error vulnerability. This vulnerability stems from integer rounding errors in the bitmap size calculation within persistentcachereadentryv2, leading to a heap buffer overflow. An attacker can create persistent cache v2 files with excessively large...

GStreamer gst-plugins-good buffer error vulnerability

GStreamer’s gst-plugins-good version prior to 1.28.2 has a buffer error vulnerability. This vulnerability stems from the qtdemuxparsechnl function in the isomp4 plugin during MP4 file parsing, which may cause out-of-bounds read access to global arrays, potentially leading to information leakage...

RIOT OS Buffer Error Vulnerability

RIOT OS versions before 2026.04 have a buffer error vulnerability. This vulnerability stems from the atwinc15x0stasetcurrentssid function in the ATWINC15x0 driver, which uses strcpy to copy an SSID without checking the target size. When MODULEATWINC15X0DYNAMICCONNECT is enabled, nearby attackers...

RIOT OS Buffer Error Vulnerability

RIOT OS versions before 2026.07 have security vulnerabilities. These vulnerabilities stem from the parsereply function in sys/net/applicationlayer/dhcpv6/client.c. This function fails to perform a minimum length validation before passing the IAPD and IANA option bodies to the sub-option parser...

Red Hat Enterprise Linux buffer error vulnerability

Red Hat Enterprise Linux versions 6, 7, and 8 have a buffer error vulnerability. This vulnerability stems from multiple migration data processing programs in spice-server using offsets provided by clients from the SPICEMSGCMIGRATEDATA message, without any boundary validation. This can allow...

FreeRTOS-FreeRTOS Kernel Buffer Error Vulnerability

FreeRTOS’s FreeRTOS-Kernel versions 11.3.0 and 11.3.1 contain security vulnerabilities. These vulnerabilities stem from the buffer length truncation during the MPU buffer authorization check in the Arm Cortex-R82 Armv8-R AArch64 MPU port. This issue may allow non-privileged tasks to read from or...

MZ Automation GmbH libiec61850 buffer error vulnerability

MZ Automation GmbH’s libiec61850 versions prior to 1.6.2 have a security vulnerability. This vulnerability stems from the parseUserInformation function, which checks if len is zero before verifying the returned negative bufPos. As a result, errors are ignored, and the buffer-1 is read, leading to...

GPAC mp4box security vulnerability

The GPAC mp4box 2.4 version has a security vulnerability. This vulnerability stems from a heap buffer overflow in the stblAddSize function isomedia/stblwrite.c, which could allow attackers to cause a denial-of-service attack by providing specially crafted MP4 files...

libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth

A flaw was found in libsoup. When max-incoming-payload-size is unlimited 0, SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data...

libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion

A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap...

libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding

A flaw was found in libsoup. The soupuridecodedatauri function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling gbase64decodeinplace. If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the si...