samba: infinite loop in mdssvc RPC service for spotlight

An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function slunpackloop did not validate a field in the network packet that contains the count of elements in an array-like...

kernel: wifi: ath11k: fix monitor mode bringup crash

A null pointer dereference vulnerability was found in the ath11k wireless driver in the Linux kernel. When an interface is brought up in monitor mode, the driver attempts to extract packet type from RAW monitor ring packets, which lack the expected structure. This causes a kernel crash due to...

kernel: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx

A flaw was identified in the Linux kernel’s ath9k wireless driver where the receiver packet handling code did not correctly validate the length of incoming SKBs before accessing subsequent fields expected to be present. In certain malformed packet conditions e.g., pktlen set too small, the driver...

kernel: net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()

An uninitialized memory access flaw was found in the Linux kernel's QRTR Qualcomm IPC Router protocol in the transmit resume handling. When processing RESUMETX messages, if the packet size is smaller than the expected control structure, the qrtrtxresume function reads uninitialized memory from th...

wireshark: Candump log file parser crash

A flaw was found in the Candump log file parser of Wireshark. This issue occurs when decoding malformed packets from a pcap file or from the network, causing a buffer overflow, resulting in a denial of service...

wireshark: VMS TCPIPtrace file parser crash

A flaw was found in the VMS TCPIPtrace file parser of Wireshark. This issue occurs when decoding malformed packets from a pcap file or from the network, causing a buffer overflow, resulting in a denial of service...

wireshark: NetScaler file parser crash

A flaw was found in the NetScaler file parser of Wireshark. This issue occurs when decoding malformed packets from a pcap file or from the network, causing a buffer overflow, resulting in a denial of service...

wireshark: RTPS dissector crash

A flaw was found in the RTPS dissector of Wireshark. This issue occurs when decoding malformed packets from a pcap file or from the network, causing a buffer overflow, resulting in a denial of service...

wireshark: XRA dissector infinite loop

A flaw was found in the XRA dissector of Wireshark. This issue occurs when decoding malformed packets from a pcap file or from the network, causing an infinite loop, resulting in a denial of service...

wireshark: IEEE C37.118 Synchrophasor dissector crash

A flaw was found in the IEEE C37.118 Synchrophasor dissector of Wireshark. This issue occurs when decoding malformed packets from a pcap file or from the network, causing a buffer overflow, resulting in a denial of service...

frr: Reachable assertion in peek_for_as4_capability function

A reachable assertion flaw was found in Frrouting frr-bgpd in the peekforas4capability function. This flaw allows an attacker to maliciously construct BGP open packets and send them to BGP peers running frr-bgpd, resulting in a denial of service...

NULL Pointer Exception bug that can be used by a remote attacker

handleipv6IpForwarding in agent/mibgroup/ip-mib/ipscalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service. Products Confirmed Not Affected Brocade Fabri...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that originates from audio memory corruption when processing VOC packet data from an ADSP...

Rocky Linux 8 : nginx:1.20 (RLSA-2022:0323)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:0323 advisory. - A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory...

Chain Halt

github.com/cosmos/packet-forward-middleware is vulnerable to a Chain Halt. The vulnerability exists because it does not properly validate IBC packets in the incoming router, allowing an attacker to cause a chain halt...

Design/Logic Flaw

A vulnerability in an API of the Web Bridge feature of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. This vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending...

CVE-2023-20244

A vulnerability in the internal packet processing of Cisco Firepower Threat Defense FTD Software for Cisco Firepower 2100 Series Firewalls could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handli...

CVE-2023-20255

A vulnerability in an API of the Web Bridge feature of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. This vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending...

Cisco Meeting Server Web Bridge Denial of Service Vulnerability

A vulnerability in an API of the Web Bridge feature of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. This vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending...

Ubuntu 23.10 : Linux kernel (StarFive) vulnerabilities (USN-6454-4)

The remote Ubuntu 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6454-4 advisory. Kyle Zeng discovered that the netfilter subsystem in the Linux kernel contained a race condition in IP set operations in certain situations. A local attacker...