9532 matches found
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: virtio-net: xsk: rx: fix the frame’s length check When calling buftoxdp, the len argument represents the length of the frame data, excluding the length of the virtio header vi-hdrlen. We check that len is not greater than the...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: BPF, ARM64: Fixed the initialization of the floating-point register for exception boundaries. When using ARM64 BPF JIT, if prog-aux-exceptionboundary is set for a BPF program, the findusedcallee regs function is not called. This ...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: media: mt9m114: Fixed deadlock in getframeinterval/ and setframeinterval The process of getting and setting the frame interval using V4L2 subdev operations causes a deadlock. This occurs because the subdev state is locked at 1, a...
CVE-2025-12464
A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This...
AZL-69631 CVE-2025-12464 affecting package qemu for versions less than 8.2.0-25
A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This...
DEBIAN-CVE-2025-12464
A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This...
Liferay Portal is vulnerable to XSS in the Blogs widget
Cross-site scripting XSS vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allow...
Siemens SIMATIC, SCALANCE and RUGGEDCOM Devices Sensitive Information in Resource Not Removed Before Reuse (CVE-2024-49997)
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiqetop: fix memory disclosure When applying padding, the buffer is not zeroed, which results in memory disclosure. The mentioned data is observed on the wire. This patch uses skbputpadto to pad Ethernet frames...
Linux Distros Unpatched Vulnerability : CVE-2025-39988
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: etases58x: populate ndochangemtu to prevent buffer overflow Sending an PFPACKET allows to bypass the CAN framework logic and to directly reach the xmit...
Siemens SIMATIC Devices Improper Handling of Structural Elements (CVE-2024-35877)
In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: fix VMPAT handling in COW mappings PAT handling won't do the right thing in COW mappings: the first PTE or, in fact, all PTEs can be replaced during write faults to point at anon folios. Reliably recovering the correc...
quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame
...
Oracle Siebel Server prior to 25.7 (October 2025 CPU)
The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory. - An excessive memory use issue CWE-770 exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME...
UBUNTU-CVE-2025-62813
LZ4 through 1.10.0 allows attackers to cause a denial of service application crash or possibly have unspecified other impact when the application processes untrusted LZ4 frames. For example, LZ4FcreateCDictadvanced in lib/lz4frame.c mishandles NULL checks...
Improper Neutralization of Null Byte or NUL Character
Overview Affected versions of this package are vulnerable to Improper Neutralization of Null Byte or NUL Character in the LZ4FcreateCDictadvanced function, when processing LZ4 frames. An attacker can cause an application to crash or trigger unintended behavior by submitting specially crafted LZ4...
EUVD-2025-35652
LZ4 through 1.10.0 allows attackers to cause a denial of service application crash or possibly have unspecified other impact when the application processes untrusted LZ4 frames. For example, LZ4FcreateCDictadvanced in lib/lz4frame.c mishandles NULL checks...
The vulnerability of the _bfd_elf_parse_eh_frame() function in the GNU Binutils development environment allows a attacker to trigger a service failure.
The vulnerability of the bfdelfparseehframe function in the GNU Binutils development environment is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to cause a system failure...
JLSEC-2025-111 `decode_frame` in `libavcodec/exr.c` in FFmpeg 4.3.1 has an out-of-bounds write because of errors in...
decodeframe in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations...
JLSEC-2025-133 A vulnerability was found in FFmpeg up to 7.0.1
A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnmdecodeframe in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed t...
JLSEC-2025-121 An issue was discovered in the FFmpeg package, where `vp3_decode_frame` in `libavcodec/vp3.c` lacks...
An issue was discovered in the FFmpeg package, where vp3decodeframe in libavcodec/vp3.c lacks check of the return value of avmalloc and will cause a null pointer dereference, impacting availability...