RHEL 8 : aspell (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - aspell: UCS-2 and UCS-4 null-terminated string handling OOB read CVE-2019-20433 - libaspell.a in GNU Aspe...

UBUNTU-CVE-2024-36934

In the Linux kernel, the following vulnerability has been resolved: bna: ensure the copied buf is NUL terminated Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from userspace to that buffer. Later, we use sscanf on this buffer but we don't ensure that the string is terminated...

CVE-2024-36931

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Ensure the copied buf is NUL terminated Currently, we allocate a lbuf-sized kernel buffer and copy lbuf from userspace to that buffer. Later, we use scanf on this buffer but we don't ensure that the string is terminated...

CVE-2024-36935 ice: ensure the copied buf is NUL terminated

In the Linux kernel, the following vulnerability has been resolved: ice: ensure the copied buf is NUL terminated Currently, we allocate a count-sized kernel buffer and copy count bytes from userspace to that buffer. Later, we use sscanf on this buffer but we don't ensure that the string is...

CVE-2024-36935

CVE-2024-36935 : In the Linux kernel, a memory copy from userspace into a kernel buffer for the ice path could miss a terminating NUL, enabling an OOB read when sscanf() is used. The fix uses memdup_user_nul instead of memdup_user to guarantee NUL termination. Affected component is the kernel’s i...

CVE-2024-36934 bna: ensure the copied buf is NUL terminated

In the Linux kernel, the following vulnerability has been resolved: bna: ensure the copied buf is NUL terminated Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from userspace to that buffer. Later, we use sscanf on this buffer but we don't ensure that the string is terminated...

CVE-2024-36935 ice: ensure the copied buf is NUL terminated

In the Linux kernel, the following vulnerability has been resolved: ice: ensure the copied buf is NUL terminated Currently, we allocate a count-sized kernel buffer and copy count bytes from userspace to that buffer. Later, we use sscanf on this buffer but we don't ensure that the string is...

CVE-2024-36934

CVE-2024-36934 concerns a Linux kernel vulnerability where a kernel buffer allocated for a userspace copy of nbytes could lack a terminating NUL, causing an out-of-bounds read when sscanf is used on the buffer. The root cause is failing to ensure the copied buffer is NUL-terminated. The fix repla...

CVE-2024-36931 s390/cio: Ensure the copied buf is NUL terminated

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Ensure the copied buf is NUL terminated Currently, we allocate a lbuf-sized kernel buffer and copy lbuf from userspace to that buffer. Later, we use scanf on this buffer but we don't ensure that the string is terminated...

CVE-2024-36931

The CVE-2024-36931 issue affects the Linux kernel on s390 architecture, specifically in s390/cio where a copied user buffer (lbuf-sized) is not guaranteed to be NUL-terminated before a scanf, enabling an out-of-bounds read. The root cause is missing termination inside the copied buffer, which is ...

CVE-2024-36931 s390/cio: Ensure the copied buf is NUL terminated

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Ensure the copied buf is NUL terminated Currently, we allocate a lbuf-sized kernel buffer and copy lbuf from userspace to that buffer. Later, we use scanf on this buffer but we don't ensure that the string is terminated...

CVE-2024-36931 s390/cio: Ensure the copied buf is NUL terminated

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Ensure the copied buf is NUL terminated Currently, we allocate a lbuf-sized kernel buffer and copy lbuf from userspace to that buffer. Later, we use scanf on this buffer but we don't ensure that the string is terminated...

CVE-2021-47240

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix OOB Read in qrtrendpointpost Syzbot reported slab-out-of-bounds Read in qrtrendpointpost. The problem was in wrong size type: if len != ALIGNsize, 4 + hdrlen goto err; If size from qrtrhdr is 4294967293 0xfffffffd,...

CVE-2021-47240

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix OOB Read in qrtrendpointpost Syzbot reported slab-out-of-bounds Read in qrtrendpointpost. The problem was in wrong size type: if len != ALIGNsize, 4 + hdrlen goto err; If size from qrtrhdr is 4294967293 0xfffffffd,...

CVE-2021-47240

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix OOB Read in qrtrendpointpost Syzbot reported slab-out-of-bounds Read in qrtrendpointpost. The problem was in wrong size type: if len != ALIGNsize, 4 + hdrlen goto err; If size from qrtrhdr is 4294967293 0xfffffffd,...

CVE-2021-47240 net: qrtr: fix OOB Read in qrtr_endpoint_post

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix OOB Read in qrtrendpointpost Syzbot reported slab-out-of-bounds Read in qrtrendpointpost. The problem was in wrong size type: if len != ALIGNsize, 4 + hdrlen goto err; If size from qrtrhdr is 4294967293 0xfffffffd,...

CVE-2021-47240 net: qrtr: fix OOB Read in qrtr_endpoint_post

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix OOB Read in qrtrendpointpost Syzbot reported slab-out-of-bounds Read in qrtrendpointpost. The problem was in wrong size type: if len != ALIGNsize, 4 + hdrlen goto err; If size from qrtrhdr is 4294967293 0xfffffffd,...

CVE-2024-22384

The CVE-2024-22384 issue is an out-of-bounds read in Intel® Trace Analyzer and Collector software prior to version 2022.0.0 that may allow an authenticated user to disclose information via local access. Affected products include Intel® Trace Analyzer and Collector (before 2022.0.0) and, per Intel...

RHEL 9 : ncurses (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - ncurses: segfaulting OOB read CVE-2022-29458 Note that Nessus has not tested for this issue but has instead relied ...

CVE-2023-38119

Foxit PDF Reader AcroForm signature Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit ...