In the Linux kernel before 5.12.4 net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan aka CID-5c4c8c954409. This leads to writing an arbitrary value.

...

CVE-2020-11174

u'Array index underflow issue in adsp driver due to improper check of channel id before used as array index.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables,...

Design/Logic Flaw

u'Array index underflow issue in adsp driver due to improper check of channel id before used as array index.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables,...

kernel: net: bluetooth: type confusion while processing AMP packets

A flaw was found in the way the Linux kernel’s Bluetooth implementation handled L2CAP Logical Link Control and Adaptation Protocol packets with A2MP Alternate MAC-PHY Manager Protocol CID Channel Identifier. This flaw allows a remote attacker in an adjacent range to crash the system, causing a...

CVE-2018-7666

An issue was discovered in ClipBucket before 4.0.0 Release 4902. SQL injection vulnerabilities exist in the actions/votechannel.php channelId parameter, the ajax/commonAjax.php email parameter, and the ajax/commonAjax.php username parameter...

ClipBucket SQL Injection Vulnerability (CNVD-2018-04993)

ClipBucket is an open source video sharing software developed by Arslan team. The software allows you to share videos to video sites and supports the lights off effect when watching a movie. A SQL injection vulnerability exists in versions prior to ClipBucket 4.0.0 Release 4902. A remote attacker...

EulerOS 2.0 SP2 : irssi (EulerOS-SA-2017-1284)

According to the versions of the irssi package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Irssi before 1.0.5, when installing themes with unterminated colour formatting sequences, may access data beyond the end of the...

EulerOS 2.0 SP1 : irssi (EulerOS-SA-2017-1283)

According to the versions of the irssi package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Irssi before 1.0.5, when installing themes with unterminated colour formatting sequences, may access data beyond the end of the...

Updated irssi packages fix security vulnerabilities

While waiting for the channel synchronization, Irssi may incorrectly fail to remove destroyed channels from the query list, resulting in use after free conditions when updating the state later on CVE-2017-15227. When installing themes with unterminated color formatting sequences, Irssi may access...

MGASA-2017-0393 Updated irssi packages fix security vulnerabilities

While waiting for the channel synchronization, Irssi may incorrectly fail to remove destroyed channels from the query list, resulting in use after free conditions when updating the state later on CVE-2017-15227. When installing themes with unterminated color formatting sequences, Irssi may access...

Irssi String Over-Reading Vulnerability

Irssi is an IRC client program with a text user interface, released under the GPL. A security vulnerability exists in versions of Irssi prior to 1.0.5, which stems from the program failing to detect if the length of a Safe channel ID is long enough. A remote attacker could use this vulnerability ...

FreeBSD : irssi -- multiple vulnerabilities (85e2c7eb-b74b-11e7-8546-5cf3fcfdd1f1)

Irssi reports : When installing themes with unterminated colour formatting sequences, Irssi may access data beyond the end of the string. While waiting for the channel synchronisation, Irssi may incorrectly fail to remove destroyed channels from the query list, resulting in use after free...

CVE-2017-15722

In certain cases, Irssi before 1.0.5 may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string...

ALPINE-CVE-2017-15722

In certain cases, Irssi before 1.0.5 may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string...

CVE-2017-15722

In certain cases, Irssi before 1.0.5 may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string...

CVE-2017-15722

In certain cases, Irssi before 1.0.5 may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string...

UBUNTU-CVE-2017-15722

In certain cases, Irssi before 1.0.5 may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string...

irssi -- multiple vulnerabilities

Irssi reports: When installing themes with unterminated colour formatting sequences, Irssi may access data beyond the end of the string. While waiting for the channel synchronisation, Irssi may incorrectly fail to remove destroyed channels from the query list, resulting in use after free conditio...

Slack: File upload over private IM channel

A team member can upload the files in the private IM chat channel of other members.This can be done by using the IM channel id. Please refer to the attached POC's. Let me know if any more details are needed...