kernel: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()

In the Linux kernel, the following vulnerability has been resolved: bpf, testrun: Fix use-after-free issue in ethskbpkttype KMSAN reported a use-after-free issue in ethskbpkttype1. The cause of the issue was that ethskbpkttype accessed skb's data that didn't contain an Ethernet header. This occur...

PT-2023-13296 · Modem · Modem

Name of the Vulnerable Software and Affected Versions: Modem affected versions not specified Description: The issue is related to information disclosure in the Modem due to a buffer over-read. This occurs when the Modem receives an IP header with a malformed length. Recommendations: At the moment...

SUSE CVE-2010-2519

Heap-based buffer overflow in the MacReadPOSTResource function in base/ftobjs.c in FreeType before 2.4.0 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted length value in a POST fragment header in a font file...

SUSE CVE-2013-4348

The skbflowdissect function in net/core/flowdissector.c in the Linux kernel through 3.12 allows remote attackers to cause a denial of service infinite loop via a small value in the IHL field of a packet with IPIP encapsulation...

SUSE CVE-2016-6835

The vmxnettxpktparseheaders function in hw/net/vmxnettxpkt.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service buffer over-read by leveraging failure to check IP header length...

SUSE CVE-2016-8740

The modhttp2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service memory consumption via crafted CONTINUATION frames in an HTTP/2 request...

SUSE CVE-2017-14137

ReadWEBPImage in coders/webp.c in ImageMagick 7.0.6-5 has an issue where memory allocation is excessive because it depends only on a length field in a header...

SUSE CVE-2020-17442

An issue was discovered in picoTCP 1.7.0. The code for parsing the hop-by-hop IPv6 extension headers does not validate the bounds of the extension header length value, which may result in Integer Wraparound. Therefore, a crafted extension header length value may cause Denial-of-Service because it...

SUSE CVE-2020-25111

An issue was discovered in the IPv6 stack in Contiki through 3.0. There is an insufficient check for the IPv6 header length. This leads to Denial-of-Service and potential Remote Code Execution via a crafted ICMPv6 echo packet...

PT-2023-35088 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v2.6.12 through v6.1.6 Description: The issue is related to the handling of extension header length in rawv6 push pending frames. The actual impact and attack plausibility have not yet been proven. Recommendations: For...

Open5GS 安全漏洞

Open5GS is an open source implementation in C of 5G Core and Epc, the core network of the Lte/Nr network. Open5GS suffers from a denial of service vulnerability that stems from insufficient validation of the extended header length, which can be exploited by an attacker to cause a denial of servic...

GSD-2023-1001724 ipv6: raw: Deduct extension header length in rawv6_push_pending_frames

ipv6: raw: Deduct extension header length in rawv6pushpendingframes This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.7 by commit...

PT-2023-34919 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.303 Description: The issue concerns the handling of extension header length in rawv6 push pending frames. It was introduced in version v2.6.12 and fixed in version v4.14.303. The actual impact and attack...

PT-2023-34909 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.270 Description: The issue is related to the handling of extension header length in rawv6 push pending frames. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

PT-2023-34871 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.164 Description: The issue concerns the handling of extension header length in rawv6 push pending frames. It was introduced in version v2.6.12 and fixed in version v5.10.164. The actual impact and attack...

PT-2023-34895 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.229 Description: The issue is related to the handling of extension header length in rawv6 push pending frames. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

The vulnerability of the Link Layer Discovery Protocol implementation in the microprogrammed software of Cisco Analog Telephone Adapter (ATA) series 190 devices allows a attacker to cause a service failure.

The vulnerability of the Link Layer Discovery Protocol LLDP implementation in the microsoftware of Cisco Analog Telephone Adapter ATA series 190 devices is related to the lack of checks for header field lengths during the processing of LLDP packets. Exploiting this vulnerability can allow a...

Buffer overflow

Azure RTOS USBX is a high-performance USB host, device, and on-the-go OTG embedded stack, that is fully integrated with Azure RTOS ThreadX. The case is, in uxhostclasspimaread, there is data length from device response, returned in the very first packet, and read by L165 code, as headerlength. Th...

CVE-2022-39293 Azure RTOS USBX Host PIMA vulnerable to read integer underflow with buffer overflow

Azure RTOS USBX is a high-performance USB host, device, and on-the-go OTG embedded stack, that is fully integrated with Azure RTOS ThreadX. The case is, in uxhostclasspimaread, there is data length from device response, returned in the very first packet, and read by L165 code, as headerlength. Th...

PT-2022-9878 · Ieee +1 · 802.2 +3

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue allows Layer 2 network filtering capabilities, such as IPv6 RA guard, to be bypassed. This can be achieved by utilizing LLC/SNAP headers with...