CVE-2015-8299

knAx20150101 Title: Vulnerabilidad de ejecución remota de código en el software de gestión KNX ETS Category/Abstract: Vulnerabilidad de desbordamiento de búfer Product: ETS Software de Herramientas de Ingeniería Affected versions: ETS 4.1.5 Build 3246 ninguna otra versión probada Fixed in version...

CVE-2020-0023

CVE-2020-0022 Seems like Android 9-6 have similar Bluetooth subsystem, Android 5 and 4 are different. Android 9.0 BlueFrag experiments Patch: https://android.googlesource.com/platform/system/bt/+/3cb7149d8fed2d7d77ceaa95bf845224c4db3baf Below I hit the patched condition. OK I think I got it, but...

Linux Distros Unpatched Vulnerability : CVE-2026-80615

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: dstmetadata: fix false-positive memcpy overflow in tundstunclone kmallocflex in metadatadstalloc sets countedby for the structure to the optionslen, which ...

CVE-2026-80615

In the Linux kernel, the following vulnerability has been resolved: net: dstmetadata: fix false-positive memcpy overflow in tundstunclone kmallocflex in metadatadstalloc sets countedby for the structure to the optionslen, which is then initialized to zero. Later, we're initializing the structure ...

CVE-2026-80615

In the Linux kernel, the following vulnerability has been resolved: net: dstmetadata: fix false-positive memcpy overflow in tundstunclone kmallocflex in metadatadstalloc sets countedby for the structure to the optionslen, which is then initialized to zero. Later, we're initializing the structure ...

CVE-2026-80615

CVE-2026-80615 affects the Linux kernel net: dst_metadata subsystem. In metadata_dst_alloc(), kmalloc_flex() sets the __counted_by annotation to options_len, which is initialized to zero . When skb_tunnel_info_unclone later copies tunnel info plus options into the structure, clang with source for...

CVE-2026-80615 net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone

In the Linux kernel, the following vulnerability has been resolved: net: dstmetadata: fix false-positive memcpy overflow in tundstunclone kmallocflex in metadatadstalloc sets countedby for the structure to the optionslen, which is then initialized to zero. Later, we're initializing the structure ...

EUVD-2026-67491

In the Linux kernel, the following vulnerability has been resolved: net: dstmetadata: fix false-positive memcpy overflow in tundstunclone kmallocflex in metadatadstalloc sets countedby for the structure to the optionslen, which is then initialized to zero. Later, we're initializing the structure ...

CVE-2026-80615 net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone

In the Linux kernel, the following vulnerability has been resolved: net: dstmetadata: fix false-positive memcpy overflow in tundstunclone kmallocflex in metadatadstalloc sets countedby for the structure to the optionslen, which is then initialized to zero. Later, we're initializing the structure ...

CVE-2026-80615

In the Linux kernel, the following vulnerability has been resolved: net: dstmetadata: fix false-positive memcpy overflow in tundstunclone kmallocflex in metadatadstalloc sets countedby for the structure to the optionslen, which is then initialized to zero. Later, we're initializing the structure ...

Astra Linux – Vulnerability in libheif

There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. An attacker could exploit this through a crafted image file to cause a buffer overflow in linear memory during a memcpy call...

CVE-2026-62292

In libheif 1.19.0–1.23.1, unc_decoder::fetch_tile_data() computes a large tile offset that, combined with range_start_offset + range_size in get_compressed_image_data_uncompressed(), wraps to zero and bypasses the bounds check. This passes an invalid source pointer and 1 TB length to memcpy, caus...

PT-2026-72346

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl: add bounds check in dfh get param size dfh get param size can return a parameter size larger than the feature region because the loop bounds check is evaluated before incrementing size. If the EOP End of Parameters bit...

CVE-2026-68447 drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cphqdcntlstacksize from hardware without bounding it to the allocated BO region. If the HW field is larger than...

Linux Distros Unpatched Vulnerability : CVE-2026-68447

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cphqdcntlstacksize from hardware without...

CVE-2026-71969

OP-TEE OS through 4.10.0, fixed in commit 7b8b494, contains a buffer underwrite vulnerability in the RSA NOPAD encrypt and decrypt operations within the mbedTLS software backend and SE050 hardware driver that allows a malicious Trusted Application to corrupt secure-world heap memory by supplying ...

CVE-2026-71969 OP-TEE OS 4.10.0 Buffer Underwrite via RSA NOPAD Encrypt/Decrypt Operations

OP-TEE OS through 4.10.0, fixed in commit 7b8b494, contains a buffer underwrite vulnerability in the RSA NOPAD encrypt and decrypt operations within the mbedTLS software backend and SE050 hardware driver that allows a malicious Trusted Application to corrupt secure-world heap memory by supplying ...

UBUNTU-CVE-2026-68293

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIA register can return up to 32 dwords 128 bytes when the device advertises the mcia32dwords capability, but struct mlx5ifcmciaregbits only defines dword0..11,...

CVE-2026-68320

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authchunklist capacity check in sctpauthepaddchunkid sctpauthepaddchunkid uses SCTPNUMCHUNKTYPES 20 as the capacity limit for ep-authchunklist, allowing it to hold up to 20 chunk entries paramhdr.length up to 24. Howeve...

UBUNTU-CVE-2026-68279

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers drmdpsidebandparseremotedpcdread reads numbytes from the raw message and then unconditionally does: memcpybytes, &raw-msgidx, numbytes; without checking that idx...