CVE-2021-3156

CVE-2021-3156 1.9.5p2 之前的 Sudo 包含一个 off-by-one 错误，可能导致堆缓冲区溢出，从而允许通过 sudoedit -s 和以单个反斜杠字符结尾的命令行参数将权限提升至 root。 致谢：安全公告由 Qualys 的 Baron Samedit 提供 如何检查你是否受影响。 sudo 项目 发布了一条命令，可用于测试你的 sudo 版本是否存在漏洞： root@kitploit: sudoedit -s '' perl -e 'print "A" x 65536' 如果你收到用法或错误消息，则说明 sudo...

CVE-2026-89620

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy writecmdtotxdma builds an output report in qsdev-reportbuf, a heap buffer allocated in quickspiallocreportbuf to the device-descriptor derived maxreportlen a fe...

CVE-2026-89620 HID: intel-thc-hid: intel-quickspi: validate report size before copy

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy writecmdtotxdma builds an output report in qsdev-reportbuf, a heap buffer allocated in quickspiallocreportbuf to the device-descriptor derived maxreportlen a fe...

CVE-2026-18495

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...

DEBIAN-CVE-2026-18495

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...

CVE-2026-18495

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...

UBUNTU-CVE-2026-18495

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...

CVE-2026-18495

CVE-2026-18495 is a heap-buffer overflow in the tiff2pdf utility within libtiff , triggered by an integer truncation error when processing a crafted BigTIFF file. A 64-bit StripByteCounts value is truncated to 32 bits, causing an undersized memory allocation followed by an out-of-bounds copy, lea...

EUVD-2026-76166

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...

CVE-2026-18495 Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...

CVE-2026-2005

CVE-2026-2005 — PostgreSQL pgcrypto 堆缓冲区溢出 目标提交： 4b324845ba5d24682b9b3708a769f00d160afbd7（PostgreSQL 18.1 — 存在漏洞） 摘要 字段| 详情 ---|--- CVE| CVE-2026-2005 类型| 堆缓冲区溢出 组件| contrib/pgcrypto/pgp-pubdec.c — pgpparsepubencsesskey 影响| 以运行 PostgreSQL 的操作系统用户身份执行任意代码（RCE） CVSS| 8.8...

CVE-2026-39113

CVE-2026-39113：SQLite 可选 SQLAR 扩展中的堆缓冲区溢出 执行摘要 CVE-2026-39113 是 SQLite 可选 SQLAR 扩展中的一个堆缓冲区溢出漏洞。在已加载该扩展的应用程序中，能够使用受控的压缩 blob 和大小调用 sqlaruncompress 的攻击者，可以在 LP64 系统上导致 zlib 在堆分配之外写入。这是宿主进程内部的内存安全边界故障；它不是 SQLite 数据库文件解析问题、认证绕过，也不是每个默认 SQLite 部署中均可触及的缺陷。 该漏洞行为于 2026-03-11 由 Git 提交 169f68e（Fossil...

NGINX-ngx_http_rewrite_module-heap-buffer-overflow-CVE-2026-9256

CVE-2026-9256 NGINX ngxhttprewritemodule PoC 推导过程与思考 适用范围：仅用于本地靶场、授权复现环境、漏洞验证和防护规则分析。不要对未授权目标使用。本文中的 PoC 思路只验证远程可见的 NGINX worker crash 行为，不包含 RCE、ASLR 绕过或稳定利用链。 1. 漏洞背景 CVE-2026-9256 是 NGINX ngxhttprewritemodule 中的堆缓冲区溢出漏洞。漏洞触发并不是单纯访问某个固定 URI，而是依赖特定的 rewrite 配置模式：rewrite 正则中存在互相重叠的 PCRE 捕获组，并且...

PoC-CVE-2025-69419

CVE-2025-69419 – OpenSSL 堆缓冲区溢出复现器 概述 此仓库包含一个针对 CVE-2025-69419 的最小概念验证复现器，该漏洞影响存在漏洞的 OpenSSL 版本。 该 PoC 演示了在处理特制的 BMPString friendlyName 时，PKCS12getfriendlyname 中报告的堆越界写入。 此项目的目标是为开发人员和安全研究人员提供一个简单的回归测试。 该 PoC 不实施漏洞利用技术 ，仅用于重现 AddressSanitizer 检测到的内存破坏。 测试版本 OpenSSL 3.0.7（ASan/UBSan 构建） 漏洞...

CVE-2022-24903-Heap-based-buffer-overflow-Hand-On-Lab

CVE-2022-24903 动手实验 作者： Andrew Beshay Mousa 一个演示 rsyslog 堆缓冲区溢出漏洞的实操实验。 一个实用的实验室环境，用于通过 TCP syslog 接收中的八位字节计数帧（octet-counted framing）复现并理解 rsyslog 堆缓冲区溢出 漏洞（CVE-2022-24903）。 目录 概述 实验架构 前提条件 漏洞详情 实验环境搭建 目标机器（Ubuntu） 攻击者机器（Kali） 漏洞利用 验证 故障排除 缓解措施 参考资料 概述 CVE-2022-24903 是 rsyslog 的 TCP syslog...

RLSA-2026:66392 Moderate: apr-util security update

The mission of the Apache Portable Runtime APR is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more. Security Fixes: apr-util: Apache Portable Runtime...

apr-util security update

An update is available for apr-util. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The mission of the Apache Portable Runtime APR is to provide a free library...

vim security update

An update is available for vim. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Vim Vi IMproved is an updated and improved version of the vi editor. Security...

apr-util security update

An update is available for apr-util. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The mission of the Apache Portable Runtime APR is to provide a free library ...

RLSA-2026:66366 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator CVE-2026-28420 vim: Vim: Denial of Service via out-of-bounds write in terminal handling CVE-2026-52859 vi...