kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()

A flaw was found in the Linux kernel's Server Message Block SMB client. The coalescet2 function processes server-supplied DataOffset fields without proper validation against buffer boundaries. A remote attacker could exploit this by crafting malicious SMB responses. This could lead to out-of-boun...

kernel: xfrm: espintcp: do not reuse an in-progress partial send

A flaw was found in the Linux kernel. The espintcp component, responsible for handling encrypted network traffic, incorrectly reuses a partial data transmission state. This can lead to an out-of-bounds read, which may allow an attacker to access sensitive information or cause other memory...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

EUVD-2026-104658

Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read...

GHSA-PCHR-8J38-3X4P Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read

Summary A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 ColorMap with 768 SHORT values:...

Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read

Summary A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 ColorMap with 768 SHORT values:...

GHSA-462X-PGG6-55FP Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

Summary Pillow's libImaging decodeTile decoder, used to decode tiled TIFF images, allocates a per-tile buffer using reallocstate-buffer, TIFFTileSizetiff. After each TIFFReadTile it then iterates tiley from 0 up to currenttilelength and calls the configured row unpacker here copy4 with the source...

EUVD-2026-104606

Pillow tiled-TIFF decoder reads past tile buffer in copy4 Unpack.c:1290...

Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

Summary Pillow's libImaging decodeTile decoder, used to decode tiled TIFF images, allocates a per-tile buffer using reallocstate-buffer, TIFFTileSizetiff. After each TIFFReadTile it then iterates tiley from 0 up to currenttilelength and calls the configured row unpacker here copy4 with the source...

GHSA-C6HW-5GRF-FF96 Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels

============================================================================ OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels Location: src/libImaging/TiffDecode.c:483 in decodeTile Commit: a707c6b21c313880d0771e54965d142dd42358b6...

Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels

============================================================================ OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels Location: src/libImaging/TiffDecode.c:483 in decodeTile Commit: a707c6b21c313880d0771e54965d142dd42358b6...

CVE-2016-20104

The EyeLock nano NXT (versions 3.05.1193 , 3.04.1108 , 3.03.944 , and 3.01.646 ) is vulnerable to a path traversal vulnerability. An unauthenticated attacker can read arbitrary local system files by sending GET requests to /scripts/logdownload.php using the 'path' parameter with traversal sequenc...

EUVD-2016-10921

EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd,...

CVE-2016-20104 EyeLock nano NXT 3.05.1193 Path Traversal via logdownload.php

EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd,...

CVE-2016-20104 EyeLock nano NXT 3.05.1193 Path Traversal via logdownload.php

EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd,...

EUVD-2026-105357

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when gnutlsrecordsend returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocked...

CVE-2026-107928

The curl utility, when compiled with GnuTLS , is vulnerable to an information disclosure flaw when interacting with a malicious WebSocket server. The root cause is an out-of-bounds read occurring because gnutls_record_send() can return a number of bytes sent exceeding the amount provided, specifi...

CVE-2026-107928 info leak uploading over WebSockets with GnuTLS

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when gnutlsrecordsend returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocked...

CVE-2026-107928

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when "gnutlsrecordsend" returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocke...

CVE-2026-107928

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when gnutlsrecordsend returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocked...