30 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-90386
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices On an empty bus ENTDAA assigns nothing, so cmd-rxlen the count of addresses left unassigned equal...
SUSE CVE-2026-89728
In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Fix out-of-bounds access for newdevs mask When software initiates DAA Dynamic Address Assignment, the controller reports the result via the NRSPQP Normal Response Queue Port Register. The data length field of the...
CVE-2026-90386
This Linux kernel vulnerability affects the DesignWare I3C master driver (drivers/i3c/master/dw-i3c-master.c:905). On an empty I3C bus, the ENTDAA (Enhanced Dynamic Address Assignment) command assigns no devices, causing cmd->rx_len to equal master->maxdevs. The resulting GENMASK() index be...
EUVD-2026-82047
In the Linux kernel, the following vulnerability has been resolved: i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices On an empty bus ENTDAA assigns nothing, so cmd-rxlen the count of addresses left unassigned equals master-maxdevs. The GENMASK index master-maxdevs - cmd-rxlen - 1 th...
CVE-2026-89728
In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Fix out-of-bounds access for newdevs mask When software initiates DAA Dynamic Address Assignment, the controller reports the result via the NRSPQP Normal Response Queue Port Register. The data length field of the...
UBUNTU-CVE-2026-89728
In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Fix out-of-bounds access for newdevs mask When software initiates DAA Dynamic Address Assignment, the controller reports the result via the NRSPQP Normal Response Queue Port Register. The data length field of the...
CVE-2026-89728 i3c: renesas: Fix out-of-bounds access for newdevs mask
In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Fix out-of-bounds access for newdevs mask When software initiates DAA Dynamic Address Assignment, the controller reports the result via the NRSPQP Normal Response Queue Port Register. The data length field of the...
CVE-2026-89728 i3c: renesas: Fix out-of-bounds access for newdevs mask
In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Fix out-of-bounds access for newdevs mask When software initiates DAA Dynamic Address Assignment, the controller reports the result via the NRSPQP Normal Response Queue Port Register. The data length field of the...
CVE-2026-89728
This vulnerability affects the Linux kernel 's Renesas I3C driver (i3c:renesas). During Dynamic Address Assignment (DAA) , the controller reports results via the NRSPQP register. When the I3C bus is empty , the data length field in the response descriptor returns the controller's maximum device c...
EUVD-2026-59805
Pandora contains a denial-of-service vulnerability in its handling of DAA Direct Access Archive files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress without enforcing a limit on the resulting uncompressed data. An attacker abl...
CVE-2026-74767
Pandora contains a denial-of-service vulnerability in its handling of DAA Direct Access Archive files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress without enforcing a limit on the resulting uncompressed data. An attacker abl...
CVE-2026-74767
Pandora has a DoS in DAA extraction: unbounded decompression of DAA chunks caused memory and CPU exhaustion. The fix uses bounded decompression (decompressobj().decompress()) with max_extracted_filesize, checks cumulative decompressed size, and raises a ZipBomb when the limit is exceeded, abortin...
CVE-2026-74767 Unbounded DAA Decompression in Pandora Allows Denial of Service via Decompression Bomb
Pandora contains a denial-of-service vulnerability in its handling of DAA Direct Access Archive files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress without enforcing a limit on the resulting uncompressed data. An attacker abl...
PT-2026-73062
Name of the Vulnerable Software and Affected Versions Pandora affected versions not specified Description Pandora contains a denial-of-service issue in its handling of DAA Direct Access Archive files. During the extraction of an internal ISO image from a DAA archive, the system uses the...
CVE-2026-74767: Unrestricted Upload of File with Dangerous Type
Pandora contains a denial-of-service vulnerability in its handling of DAA Direct Access Archive files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress without enforcing a limit on the resulting uncompressed data. An attacker abl...
broken-source (0.9.0.dev1), daa-music (>=0.0.2, <=0.0.5) +9 more potentially affected by CVE-2026-55404 via yt-dlp (2025.3.31)
yt-dlp PYPI version 2025.3.31 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - broken-source 0.9.0.dev1 - daa-music =0.0.2, =0.0.2.3, =2.0.9, =2025.4.2, =2025.4.18 Source cves: CVE-2026-55404 Source advisory:...
EUVD-2025-139343
Malicious code in nurai-sutaf-daa npm...
Malicious code in nurai-sutaf-daa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c3636e7e220de4258cc7b31562a32b2e21428c5327aee19fc1f62e79f06019c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-176913 Malicious code in nurai-sutaf-daa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c3636e7e220de4258cc7b31562a32b2e21428c5327aee19fc1f62e79f06019c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...