552 matches found
CVE-2026-28364
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization runtime/intern.c enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock function, which performs unbounded memcpy operation...
CVE-2026-23747 Golioth Firmware SDK < 0.22.0 Payload Utils Stack-based Buffer Overflow
Golioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit 48f521b, contain a stack-based buffer overflow in Payload Utils. The goliothpayloadasint and goliothpayloadasfloat helpers copy network-supplied payload data into fixed-size stack buffers using memcpy with a length derived from...
CVE-2026-23747
The CVE affects Golioth Firmware SDK versions 0.10.0 up to 0.21.x (fixed in v0.22.0). A stack-based buffer overflow occurs in Payload Utils via golioth_payload_as_int() and golioth_payload_as_float(), which copy network-provided payload data into fixed-size stack buffers using memcpy() with a len...
PT-2026-22292
Name of the Vulnerable Software and Affected Versions OCaml versions prior to 4.14.3 and 5.x versions prior to 5.4.1 Description A flaw exists in OCaml's Marshal deserialization process within runtime/intern.c that could allow for remote code execution. This issue stems from a missing bounds chec...
kernel: svcrdma: use rc_pageoff for memcpy byte offset
In the Linux kernel, the following vulnerability has been resolved: svcrdma: use rcpageoff for memcpy byte offset svcrdmacopyinlinerange added rccurpage page index to the page base instead of the byte offset rcpageoff. Use rcpageoff so copies land within the current page. Found by ZeroPath...
Moderate: kernel security update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ntbhwswitchtec: Fix shift-out-of-bounds in switchtecntbmwsettrans CVE-2023-53034 kernel: smc: Fix use-after-free in pnetfindbasendev CVE-2025-40064 kernel: Linux kernel: Out-of-bounds wri...
PT-2026-22922
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The UFX IOCTL REPORT DAMAGE ioctl does not correctly copy data from user space to kernel space. Instead, it directly references the memory, which can lead to issues if invalid data is...
kernel: svcrdma: use rc_pageoff for memcpy byte offset
In the Linux kernel, the following vulnerability has been resolved: svcrdma: use rcpageoff for memcpy byte offset svcrdmacopyinlinerange added rccurpage page index to the page base instead of the byte offset rcpageoff. Use rcpageoff so copies land within the current page. Found by ZeroPath...
AZL-75020 CVE-2026-0988 affecting package glib 2.71.0-9
A flaw was found in glib. Missing validation of offset and count parameters in the gbufferedinputstreampeek function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy, triggering...
CVE-2026-0988
A flaw was found in glib. Missing validation of offset and count parameters in the gbufferedinputstreampeek function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy, triggering...
MiracleLinux 8 : libtiff-4.0.9-29.el8 (AXSA:2023-6460:07)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6460:07 advisory. libtiff: out-of-bounds write in extractContigSamplesShifted16bits in tools/tiffcrop.c CVE-2023-0800 libtiff: out-of-bounds write in TIFFmemcpy in...
SUSE CVE-2025-68811
In the Linux kernel, the following vulnerability has been resolved: svcrdma: use rcpageoff for memcpy byte offset svcrdmacopyinlinerange added rccurpage page index to the page base instead of the byte offset rcpageoff. Use rcpageoff so copies land within the current page. Found by ZeroPath...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002282)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002282 advisory. Buffer overflow in the completeemulatedmmio function in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the...
gnupg2 security update
2.2.20-4 - Fix CVE-2025-68973 gpg.fail/memcpy...
Oracle Linux 10 : gnupg2 (ELSA-2026-0697)
The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-0697 advisory. - Fix CVE-2025-68973 gpg.fail/memcpy Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus h...
CVE-2025-71120 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauthgss: avoid NULL deref on zero length gsstoken in gssreadproxyverf A zero length gsstoken results in pages == 0 and intoken-pages0 is NULL. The code unconditionally evaluates pageaddressintoken-pages0 for the initia...
Buffer-Overflow-Shellcode-Exploitation
Buffer Overflow & Shellcode Exploitation Overview This pr...
CVE-2025-68811
In the Linux kernel, the following vulnerability has been resolved: svcrdma: use rcpageoff for memcpy byte offset svcrdmacopyinlinerange added rccurpage page index to the page base instead of the byte offset rcpageoff. Use rcpageoff so copies land within the current page. Found by ZeroPath...
CVE-2025-68811
In the Linux kernel, the following vulnerability has been resolved: svcrdma: use rcpageoff for memcpy byte offset svcrdmacopyinlinerange added rccurpage page index to the page base instead of the byte offset rcpageoff. Use rcpageoff so copies land within the current page. Found by ZeroPath...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: net/9p: Fixed buffer overflow in the USB transport layer. There is a buffer overflow vulnerability in the USB 9pfs transport layer. In this case, inconsistencies in size validation between packet header parsing and actual data...