CVE-2026-0861 Integer overflow in memalign leads to heap corruption

Passing too large an alignment to the memalign suite of functions memalign, posixmemalign, alignedalloc in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption. Note that the attacker must have control over both, the size a...

[SECURITY] [DLA 4438-1] mongo-c-driver security update

Debian LTS Advisory DLA-4438-1 [email protected] https://www.debian.org/lts/security/ Roberto C. Sánchez January 14, 2026 https://wiki.debian.org/LTS Package : mongo-c-driver Version : 1.17.6-1+deb11u2 CVE ID : CVE-2025-12119 A vulnerability has been discovered in mongo-c-driver, the...

CVE-2026-22791

A flaw was found in openCryptoki, a library for cryptographic operations. A local attacker can exploit a heap buffer overflow vulnerability within the CKMECDHAESKEYWRAP implementation. By providing a compressed Elliptic Curve EC public key and invoking the CWrapKey function, the attacker can...

UBUNTU-CVE-2025-71108

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Handle incorrect numconnectors capability The UCSI spec states that the numconnectors field is 7 bits, and the 8th bit is reserved and should be set to zero. Some buggy FW has been known to set this bit, and it...

CVE-2025-71108

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Handle incorrect numconnectors capability The UCSI spec states that the numconnectors field is 7 bits, and the 8th bit is reserved and should be set to zero. Some buggy FW has been known to set this bit, and it...

CVE-2025-71108 usb: typec: ucsi: Handle incorrect num_connectors capability

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Handle incorrect numconnectors capability The UCSI spec states that the numconnectors field is 7 bits, and the 8th bit is reserved and should be set to zero. Some buggy FW has been known to set this bit, and it...

CVE-2025-71108

CVE-2025-71108 refers to a Linux kernel vulnerability in the USB Type-C UCSI handling. The underlying issue is that the 8th bit of the num_connectors field is reserved and should be zero, but some buggy firmware sets it, which can cause a system to fail to boot. The description notes that the ker...

CVE-2025-71108

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Handle incorrect numconnectors capability The UCSI spec states that the numconnectors field is 7 bits, and the 8th bit is reserved and should be set to zero. Some buggy FW has been known to set this bit, and it...

Hackers Exploit c-ares DLL Side-Loading to Bypass Security and Deploy Malware

Security experts have disclosed details of an active malware campaign that's exploiting a DLL side-loading vulnerability in a legitimate binary associated with the open-source c-ares library to bypass security controls and deliver a wide range of commodity trojans and stealers. "Attackers achieve...

GNU C Library 安全漏洞

The GNU C Library is an open source, free C language compiler from the GNU community released under the LGPL license. A security vulnerability exists in the GNU C Library versions 2.30 through 2.42, which stems from the fact that passing too large an alignment value to the memalign family of...

TencentOS Server 3: glibc (TSSA-2025:0993)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0993 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

MiracleLinux 3 : glibc-2.5-81.4.0.1.AXS3 (AXSA:2012-695:04)

The remote MiracleLinux 3 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2012-695:04 advisory. The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make...

MiracleLinux 4 : glibc-2.12-1.7.AXS4.5 (AXSA:2011-142:02)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2011-142:02 advisory. The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as t...

Debian dla-4438 : libbson-1.0-0 - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4438 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4438-1 [email protected] https://www.debian.org/lts/security/...

PT-2026-2957

Name of the Vulnerable Software and Affected Versions GNU C Library versions 2.30 through 2.42 Description Providing an excessively large alignment value to the memalign family of functions – including memalign, posix memalign, aligned alloc, valloc, and pvalloc – within the GNU C Library can lea...

DLA-4438-1 mongo-c-driver - security update

Bulletin has no description...

MiracleLinux 3 : glibc-2.5-65.3.0.1.AXS3 (AXSA:2012-210:01)

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-210:01 advisory. The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as t...

MiracleLinux 3 : glibc-2.5-58.2.0.1.AXS3 (AXSA:2011-151:01)

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2011-151:01 advisory. The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as t...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: libceph: fixed invalid accesses to cephconnectionv1info. There is a place where generic code in messenger.c reads from certain fields, and another place where it writes to members of the con-v1 union without checking that those...

Astra Linux – Vulnerability in cjson

In versions of cJSON 1.5.0 through 1.7.18, the decodearrayindexfrompointer function in cJSONUtils.c allows for out-of-bounds access. This enables remote attackers to bypass array bounds checking and access restricted data through malformed JSON pointer strings containing alphanumeric characters...