firefox: Integer overflow in the Layout: Text and Fonts component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Integer overflow in the Layout: Text and Fonts component...

firefox: Integer overflow in the Graphics component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Integer overflow in the Graphics component...

xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize

A flaw was found in xorg-x11-server. Due to an integer truncation issue during memory allocation calculations within the X Keyboard Extension XKB, the server allocates an undersized buffer when resizing key types. An authenticated local client can exploit this vulnerability by sending specially...

firefox: Integer overflow in the Layout: Text and Fonts component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Integer overflow in the Layout: Text and Fonts component...

firefox: Integer overflow in the Graphics component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Integer overflow in the Graphics component...

libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks

An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity...

Important: Red Hat Security Advisory: libxml2 security update

An update for libxml2 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow

A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the xmlDictAddQString function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its...

libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation

A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure,...

Important: Red Hat Security Advisory: libxml2 security update

An update for libxml2 is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks

An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity...

libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow

A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the xmlDictAddQString function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its...

libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation

A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure,...

firefox: Integer overflow in the Layout: Text and Fonts component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Integer overflow in the Layout: Text and Fonts component...

firefox: Integer overflow in the Graphics component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Integer overflow in the Graphics component...

CLSA-2026-1792983235 Fix of 56 CVEs

CVE-2026-98706 - wifi: mac80211: drain PS delivery work during station teardown CVE-2026-98706 CVE-2026-98836 - ALSA: line6: reject oversized playback packets CVE-2026-98836 CVE-2026-98548 - sctp: discard the rest of the packet on a stale-cookie error CVE-2026-98548 CVE-2026-98614 - sctp: avoid...

CLSA-2026-1792980237 Fix of 276 CVEs

CVE-2022-49416 - wifi: mac80211: fix use-after-free in chanctx code CVE-2022-49416 CVE-2022-49685 - iio: trigger: sysfs: fix use-after-free on remove CVE-2022-49685 CVE-2021-47670 - can: peakusb: fix use after free bugs CVE-2021-47670 CVE-2026-98706 - wifi: mac80211: drain PS delivery work during...

CLSA-2026-1792979087 kernel: Fix of 118 CVEs

Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count CVE-2026-64276 - media: av7110: prevent underflow in writetstodecoder CVE-2023-54284 - usb: usbtmc: check URB actuallength for interrupt-IN notifications CVE-2026-63904 - usb: usbfs: fix use-after-free of usbdevice in...

CLSA-2026-1792977831 kernel: Fix of 118 CVEs

Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count CVE-2026-64276 - media: av7110: prevent underflow in writetstodecoder CVE-2023-54284 - usb: usbtmc: check URB actuallength for interrupt-IN notifications CVE-2026-63904 - usb: usbfs: fix use-after-free of usbdevice in...

CVE-2026-106676

qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creation flow does not validate the resulting quantity and passes it to the stock update query, increasing inventory and...