CVE-2023-45675

stbvorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds write in f-vendorlen = char'\0';. The root cause is that if the len read in startdecoder is -1 and len + 1 becomes 0 when passed to setupmalloc. The setupmalloc behaves...

PT-2026-22234

Name of the Vulnerable Software and Affected Versions Crypt::SysRandom::XS versions prior to 0.010 Description The software contains a flaw in the random bytes function where it does not properly validate the input length parameter. Supplying a negative value for length can lead to an integer...

PT-2026-8385

Name of the Vulnerable Software and Affected Versions Crypt::URandom versions 0.41 through 0.55 Description The Perl module Crypt::URandom is susceptible to a heap buffer overflow within the crypt urandom getrandom function. The issue arises because the function does not properly validate the...

SUSE CVE-2023-54284

In the Linux kernel, the following vulnerability has been resolved: media: av7110: prevent underflow in writetstodecoder The buf4 value comes from the user via tsplay. It is a value in the u8 range. The final length we pass to av7110ipackinstantrepack is "len - buf4 + 1 - 4" so add a check to...

UBUNTU-CVE-2023-54284

In the Linux kernel, the following vulnerability has been resolved: media: av7110: prevent underflow in writetstodecoder The buf4 value comes from the user via tsplay. It is a value in the u8 range. The final length we pass to av7110ipackinstantrepack is "len - buf4 + 1 - 4" so add a check to...

CVE-2023-54284

CVE-2023-54284 : Linux kernel vulnerability in the media/av7110 path. The issue arises from underflow-prone length calculation in write_ts_to_decoder(), where buf[4] is user-controlled via ts_play(). The intended final length passed to av7110_ipack_instant_repack() is computed as len - (buf[4] + ...

Security update for mozjs52

This update for mozjs52 fixes the following issues: CVE-2024-45491: Fixed integer overflow in dtdCopy bsc1230037 CVE-2024-50602: Fixed DoS via XMLResumeParser bsc1232599 CVE-2024-45492: Fixed integer overflow in function nextScaffoldPart bsc1230038 CVE-2024-45490: Fixed negative len for...

SUSE-SU-2025:4512-1 Security update for mozjs52

This update for mozjs52 fixes the following issues: - CVE-2024-45491: Fixed integer overflow in dtdCopy bsc1230037 - CVE-2024-50602: Fixed DoS via XMLResumeParser bsc1232599 - CVE-2024-45492: Fixed integer overflow in function nextScaffoldPart bsc1230038 - CVE-2024-45490: Fixed negative len for...

Siemens SCALANCE and RUGGEDCOM Devices Improper Input Validation (CVE-2024-42084)

ftruncate: passing a negative length accidentally succeeds in truncating to file size between 2GiB and 4GiB. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if descripti...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990249)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990249 advisory. In the Linux kernel, the following vulnerability has been resolved: ftruncate: pass a signed offset The old ftruncate syscall, using the 32-bit offt misses a sign...

CLSA-2025-1761902260 Fix CVE(s): CVE-2024-45490

SECURITY UPDATE: Improper restriction of XML External Entity Reference - debian/patches/CVE-2024-45490.patch: Reject negative len for XMLParseBuffer - CVE-2024-45490...

Linux Distros Unpatched Vulnerability : CVE-2023-53726

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: arm64: csum: Fix OoB access in IP checksum code for negative lengths Although commit...

UBUNTU-CVE-2023-53726

In the Linux kernel, the following vulnerability has been resolved: arm64: csum: Fix OoB access in IP checksum code for negative lengths Although commit c2c24edb1d9c "arm64: csum: Fix pathological zero-length calls" added an early return for zero-length input, syzkaller has popped up with an...

CVE-2023-53726: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: arm64: csum: Fix OoB access in IP checksum code for negative lengths Although commit c2c24edb1d9c "arm64: csum: Fix pathological zero-length calls" added an early return for zero-length input, syzkaller has popped up with an...

JLSEC-2025-62 An issue was discovered in libexpat before 2.6.3

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XMLParseBuffer...

EUVD-2018-11349

Malware in sbrugna...

EUVD-2011-2683

Malware in sbrugna...

EUVD-2025-20035

Malicious code in bioql PyPI...

The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.

...

SUSE CVE-2023-53365

In the Linux kernel, the following vulnerability has been resolved: ip6mr: Fix skbunderpanic in ip6mrcachereport skbuff: skbunderpanic: text:ffffffff88771f69 len:56 put:-4 head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg ------------ cut here ------------ kernel BUG at...