541 matches found
vbox-ovf-nat-tftp-prefix
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · vbox-ovf-nat-tftp-prefix Write-up: https://abraxaslabs.tech/research/virtualbox-7-2-20-leftovers vbox-ovf-nat-tftp-prefix Class: File read Reach: Local guest after UI:R import Oracle VM VirtualBox OSS 7.2.20 f2792cf44...
slirp_snapshots_stateful
slirpsnapshotsstateful Install and run step 0: install dependencies sudo apt install meson ninja-build valgrind clang-20 binutils libglib-2.0-dev cmake python3-venv Install a Rust toolchain. step 1: clone libafl clone libafl next to the fuzzer directory and checkout the right commit git clone...
Important: qemu
Issue Overview: A flaw was found in QEMU's websocket I/O channel QIOChannelWebsock in io/channel-websock.c. The websocket server reads encoded data from a connected client into an input buffer and decodes it into a separate buffer, but the size limit is enforced only on the encoded-input buffer a...
AlmaLinux 9.2 [TuxCare] Security Update: libslirp / libslirp-devel (ALMALINUX9.2:CLSA-2026:1794351548)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1794351548 advisory. - A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small...
AlmaLinux 9.6 [TuxCare] Security Update: libslirp / libslirp-devel (ALMALINUX9.6:CLSA-2026:1794351730)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1794351730 advisory. - A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small...
Rocky Linux 9.6 [TuxCare] Security Update: libslirp / libslirp-devel (ALMALINUX9.6:CLSA-2026:1794351730)
The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1794351730 advisory. - A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small...
CVE-2026-115449 affecting package libslirp for versions less than 4.9.6-1
CVE-2026-115449 affecting package libslirp for versions less than 4.9.6-1. An upgraded version of the package is available that resolves this issue...
SUSE CVE-2026-120830
A flaw was found in libslirp in icmpforwarderror. When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host...
SUSE CVE-2026-120831
A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...
CVE-2026-120831
A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...
CVE-2026-120830
A flaw was found in libslirp in icmpforwarderror. When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host...
DEBIAN-CVE-2026-120831
A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...
CVE-2026-120831
A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...
AZL-112682 CVE-2026-120831 affecting package libslirp for versions less than 4.9.7-1
A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...
UBUNTU-CVE-2026-120831
A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...
CVE-2026-120831 Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service
A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...
CVE-2026-120831
A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...
CVE-2026-120831 Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service
A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...
CVE-2026-120831
A flaw exists in libslirp within the if_output() function. When a session moves from the fast queue to the batch queue, the code incorrectly unlinks and reinserts an arbitrary packet via ifm->m_nextpkt instead of the session queue head. This leads to queue pointer corruption . A guest generati...
CVE-2026-120831 Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service
A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...