CVE-2024-57255

A flaw was found in Das U-Boot. This vulnerability allows an attacker to cause a memory overwrite via a crafted SquashFS filesystem with an inode size of 0xffffffff, which can lead to code execution or system crash. Mitigation Mitigation for this issue is either not available or the currently...

SUSE-SU-2025:0586-1 Security update for grub2

This update for grub2 fixes the following issues: - CVE-2024-45781: Fixed strcpy overflow in ufs. bsc1233617 - CVE-2024-56737: Fixed a heap-based buffer overflow in hfs. bsc1234958 - CVE-2024-45782: Fixed strcpy overflow in hfs. bsc1233615 - CVE-2024-45780: Fixed an overflow in tar/cpio. bsc12336...

CVE-2024-57262

In barebox before 2025.01.0, ext4fsreadsymlink has an integer overflow for zalloc adding one to an le32 variable via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite, a related issue to CVE-2024-57256...

PT-2025-16661

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved by adding a read-only check before calling txBeginAnon in extAlloc and extRecord. This prevents modification attempts on a read-only...

CVE-2024-57262: Integer Overflow or Wraparound

In barebox before 2025.01.0, ext4fsreadsymlink has an integer overflow for zalloc adding one to an le32 variable via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite, a related issue to CVE-2024-57256...

PT-2025-16660

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved by adding a check for "read-only" mode in the jfs truncate nolock function to avoid errors related to writing to a read-only...

CVE-2024-57262

In barebox before 2025.01.0, ext4fsreadsymlink has an integer overflow for zalloc adding one to an le32 variable via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite, a related issue to CVE-2024-57256...

CVE-2024-57262

CVE-2024-57262 affects barebox prior to 2025.01.0. The flaw is in ext4fs_read_symlink, where a zalloc overflow (adding one to an le32) on a crafted ext4 filesystem with inode size 0xffffffff causes a malloc(0) and a subsequent memory overwrite. This yields a high-severity impact (memory corruptio...

CVE-2024-57262

In barebox before 2025.01.0, ext4fsreadsymlink has an integer overflow for zalloc adding one to an le32 variable via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite, a related issue to CVE-2024-57256...

CVE-2024-57262

In barebox before 2025.01.0, ext4fsreadsymlink has an integer overflow for zalloc adding one to an le32 variable via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite, a related issue to CVE-2024-57256...

CVE-2025-24965: Improper Limitation of a Pathname to a Restricted Directory

crun is an open source OCI Container Runtime fully written in C. In affected versions A malicious container image could trick the krun handler into escaping the root filesystem, allowing file creation or modification on the host. No special permissions are needed, only the ability for the current...

CVE-2024-57257

A stack consumption issue in sqfssize in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting...

CVE-2024-57258

Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdifft is mishandled on x8664...

CVE-2024-57254

An integer overflow in sqfsinodesize in Das U-Boot before 2025.01-rc1 occurs in the symlink size calculation via a crafted squashfs filesystem...

CVE-2024-57255

An integer overflow in sqfsresolvesymlink in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite...

UBUNTU-CVE-2024-57256

An integer overflow in ext4fsreadsymlink in Das U-Boot before 2025.01-rc1 occurs for zalloc adding one to an le32 variable via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite...

CVE-2024-45783

A flaw was found in grub2. When failing to mount an HFS+ grub, the hfsplus filesystem driver doesn't properly set an ERRNO value. This issue may lead to a NULL pointer access...

CVE-2024-45782

A flaw was found in the HFS filesystem. When reading an HFS volume's name at grubfsmount, the HFS filesystem driver performs a strcpy using the user-provided volume name as input without properly validating the volume name's length. This issue may read to a heap-based out-of-bounds writer,...

CVE-2025-0685

A flaw was found in grub2. When reading data from a jfs filesystem, grub's jfs filesystem module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciouly crafted filesystem may lead some o...

CVE-2025-0684

A flaw was found in grub2. When performing a symlink lookup from a reiserfs filesystem, grub's reiserfs fs module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciouly crafted filesyste...