CVE-2023-53391: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: shmem: use ramfskillsb for killsb method of ramfs-based tmpfs As the ramfs-based tmpfs uses ramfsinitfscontext for the initfscontext method, which allocates fc-sfsinfo, use ramfskillsb to free it and avoid a memory leak...

PT-2025-38370

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak was resolved in the Linux kernel’s shmem implementation. Specifically, the ramfs-based tmpfs was not correctly freeing memory allocated for its filesystem context fc-s fs...

CVE-2025-32438

make-initrd-ng is a tool for copying binaries and their dependencies. Local privilege escalation affecting all NixOS users. With systemd.shutdownRamfs.enable enabled the default a local user is able to create a program that will be executed by root during shutdown. Patches exist for NixOS 24.11 a...

kernel: Linux kernel: Memory leak in shmem's ramfs-based tmpfs leads to denial of service

A flaw was found in the Linux kernel's shared memory shmem component, specifically within its ramfs-based temporary file system tmpfs implementation. A local user could exploit this vulnerability due to improper memory deallocation. This oversight can lead to a memory leak, potentially causing a...

CVE-2021-31870

An issue was discovered in klibc before 2.0.9. Multiplication in the calloc function may result in an integer overflow and a subsequent heap buffer overflow...

CVE-2017-18020

On Samsung mobile devices with L5.x, M6.x, and N7.x software and Exynos chipsets, attackers can execute arbitrary code in the bootloader because S Boot omits a size check during a copy of ramfs data to memory. The Samsung ID is SVE-2017-10598...

Samsung Mobile Device Arbitrary Code Execution Vulnerability

Samsung mobile devices are smart mobile devices manufactured by Samsung in South Korea.Android L, M, and N are a set of different versions of the Linux-based open source operating system developed by Google and the Open Handset Alliance OHA.Exynos Exynos chipsets are processors designed and...

CVE-2017-18020: Improper Input Validation

On Samsung mobile devices with L5.x, M6.x, and N7.x software and Exynos chipsets, attackers can execute arbitrary code in the bootloader because S Boot omits a size check during a copy of ramfs data to memory. The Samsung ID is SVE-2017-10598...

PT-2017-3604

Name of the Vulnerable Software and Affected Versions: Samsung Mobile devices with L5.x software Samsung Mobile devices with M6.x software Samsung Mobile devices with N7.x software Description: The issue exists due to insufficient input validation in the S Boot loader of the Samsung Mobile...

Cisco ASA Clientless SSL VPN Portal Customization Integrity Vulnerability (cisco-sa-20141008-asa)

A vulnerability in the Clientless SSL VPN portal customization framework could allow an unauthenticated, remote attacker to modify the content of the Clientless SSL VPN portal, which could lead to several attacks including the stealing of credentials, cross-site scripting XSS, and other types of...

Cisco ASA Software SharePoint RAMFS Integrity and Lua Injection Vulnerabilities (CSCup54208 and CSCup54184)

According to its banner, the version of the Cisco ASA software on the remote device is affected by a vulnerability in its SSL VPN code due to improper validation of session information for the SSL VPN when a SharePoint handler is created. This allows a remote, authenticated attacker to overwrite...

CVE-2014-3393

The Clientless SSL VPN portal customization framework in Cisco ASA Software 8.2 before 8.25.51, 8.3 before 8.32.42, 8.4 before 8.47.23, 8.6 before 8.61.14, 9.0 before 9.04.24, 9.1 before 9.15.12, and 9.2 before 9.22.4 does not properly implement authentication, which allows remote attackers to...

Authentication flaw

The Clientless SSL VPN portal customization framework in Cisco ASA Software 8.2 before 8.25.51, 8.3 before 8.32.42, 8.4 before 8.47.23, 8.6 before 8.61.14, 9.0 before 9.04.24, 9.1 before 9.15.12, and 9.2 before 9.22.4 does not properly implement authentication, which allows remote attackers to...

CVE-2014-3393: Improper Authentication

The Clientless SSL VPN portal customization framework in Cisco ASA Software 8.2 before 8.25.51, 8.3 before 8.32.42, 8.4 before 8.47.23, 8.6 before 8.61.14, 9.0 before 9.04.24, 9.1 before 9.15.12, and 9.2 before 9.22.4 does not properly implement authentication, which allows remote attackers to...

Cisco ASA Clientless SSL VPN Portal Customization Integrity Vulnerability

A vulnerability in the Clientless SSL VPN portal customization framework could allow an unauthenticated, remote attacker to modify the content of the Clientless SSL VPN portal, which could lead to several attacks including the stealing of credentials, cross-site scripting XSS, and other types of...

PT-2014-5283 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco ASA Software versions 8.2 through 8.25.50 Cisco ASA Software versions 8.3 through 8.32.41 Cisco ASA Software versions 8.4 through 8.47.22 Cisco ASA Software versions 8.6 through 8.61.13 Cisco ASA Software versions 9.0 through 9.04.23...

Cisco ASA Software SharePoint RAMFS Integrity and Lua Injection Vulnerability

A vulnerability in the SSL VPN code of Cisco ASA Software could allow an authenticated, remote attacker to overwrite arbitrary files present on the RAMFS file system or inject Lua scripts. The vulnerability is due to insufficient validation of the code that handles session information for the SSL...

PT-2014-5289

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance ASA Software versions 9.2.2.4 and earlier Description The issue is related to the SSL VPN implementation, which does not properly manage session information during the creation of a SharePoint handler. This...