2090 matches found
sfop
Segmentation Fault-Oriented Programming SFOP これは、Segmentation Fault-Oriented Programming 攻撃手法に関する成果物リポジトリです。 成果物コレクション ここでは、このリポジトリ内の成果物について簡単に説明します。全部で8つの成果物があり、6つの PoC エクスプロイトと、実世界のプログラム（Nginx と Ladybird）に対する2つのエクスプロイトで構成されています。 PoC: bSFOPek: シグナルを登録するチェーンと Early Kill を使用して攻撃を開始する、完全な bSFOP...
CVE-2022-34913
CVE-2022-34913 の説明 md2roff 1.7 は、大量の連続した文字を含む Markdown ファイルを処理する際にスタックベースのバッファオーバーフローを引き起こします。 再現方法 脆弱性を再現するには、脆弱なバージョンの md2roff（バージョン 1.7）をダウンロードする必要があります。 git clone https://github.com/nereusx/md2roff.git cd md2roff git checkout 7fc373d25c91422454f081c8a717222d77fd7add make...
CVE-2022-34556
CVE-2022-34556 の説明 PicoC v3.2.2 には、variable.c に NULL ポインタ参照の脆弱性があることが判明しました。Picoc を使用するプロジェクトやライブラリも、この問題の影響を受けます。例としては、picoc-js が挙げられます。 環境のセットアップ PicoC の NULL ポインタ参照の脆弱性を再現するには、まず PicoC ライブラリとインタプリタの脆弱性のあるバージョン v3.2.2 をダウンロードしてコンパイルする必要があります: git clone https://github.com/jpoirier/picoc.git cd...
bigdecimal-segfault-fix
h1. BigDecimal Segfault Fix BigDecimalライブラリにセグフォルトバグがあり、既知の不正な値をユーザーが提供することでトリガーされる可能性があります。アプリケーションが安全かどうかをテストするには、+example.rb+ を実行してください。このスクリプトは正常に終了し、セグフォルトを起こさないはずです。 この回避策には副作用があります。具体的には、BigDecimal を使用して大きな数値（255桁以上）を扱うことや、科学的記数法（例：5000000に対して...
Rocky Linux 9 [CIQ] Security Update: ncurses / ncurses-base / ncurses-c++-libs / etc (crlsa-2025_12876)
The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202512876 advisory. ncurses: segfaulting OOB read CVE-2022-29458 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessus has no...
Rocky Linux 8 [CIQ] Security Update: gcc-toolset-12-binutils / gcc-toolset-12-binutils-debuginfo / etc (crlsa-2023_2873)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20232873 advisory. binutils: NULL pointer dereference in bfdelfgetsymbolversionstring leads to segfault CVE-2022-4285 Tenable has extracted the preceding description block directly fr...
Rocky Linux 8 [CIQ] Security Update: binutils / binutils-debuginfo / binutils-debugsource / etc (crlsa-2023_6236)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20236236 advisory. binutils: NULL pointer dereference in bfdelfgetsymbolversionstring leads to segfault CVE-2022-4285 Tenable has extracted the preceding description block directly fr...
Rocky Linux 8 [CIQ] Security Update: raptor2 / raptor2-debuginfo / raptor2-debugsource / raptor2-devel Multiple Vulnerabilities (crlsa-2021_1842)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20211842 advisory. raptor: heap-based buffer overflows due to an error in calculating the maximum nspace declarations for the XML writer CVE-2017-18926 raptor2: malformed inp...
Rocky Linux 8 [CIQ] Security Update: perl-JSON-XS / perl-JSON-XS-debuginfo / perl-JSON-XS-debugsource (crlsa-2025_17163)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202517163 advisory. JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON CVE-2025-40928 Tenable has extracted the preceding description block directly from th...
Rocky Linux 9 [CIQ] Security Update: perl-JSON-XS / perl-JSON-XS-debuginfo / perl-JSON-XS-debugsource (crlsa-2025_17162)
The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202517162 advisory. JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON CVE-2025-40928 Tenable has extracted the preceding description block directly from th...
Rocky Linux 10.0 [CIQ] Security Update: perl-JSON-XS / perl-JSON-XS-debuginfo / perl-JSON-XS-debugsource (crlsa-2025_17119)
The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202517119 advisory. JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON CVE-2025-40928 Tenable has extracted the preceding description block directly from...
TencentOS Server 4: expat (TSSA-2026:1058)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1058 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
SUSE-SU-2026:4348-1 Security update for glib2
This update for glib2 fixes the following issue: - CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded SASL line buffering bsc1272206. Changes for glib2: - Fix segfault when monitoring hard links bsc1281419...
rsyslog security update
8.2510.0-2.0.1.el98.2 - Fixes rsyslog segfault during shutdown when relp is configured with TLS Orabug: 37588023 8.2510.0-2.2 - Fix CVE-2026-78002: heap buffer overflow in RainerScript replace function Resolves: RHEL-246641 8.2510.0-2.1 - Backport: imptcp: guard regex-framing match against...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libxml2 (UTSA-2023-001598)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-001598 advisory. In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: raptor2 (UTSA-2026-054035)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054035 advisory. A malformed input file can lead to a segfault due to an out of bounds array access in raptorxmlwriterstartelementcommon. Tenable has extracted the preceding...
DEBIAN-CVE-2026-93894
In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper and .lower string type methods of VCL. This can be used as a remote denial of service DoS vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability...
Oracle Linux 9 : rsyslog (ELSA-2026-67583)
The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-67583 advisory. 8.2510.0-2.0.1.el98.1 - Fixes rsyslog segfault during shutdown when relp is configured with TLS Orabug: 37588023 8.2510.0-2.1 - Backport: imptcp: guard...
rsyslog security update
8.2510.0-2.0.1.el98.1 - Fixes rsyslog segfault during shutdown when relp is configured with TLS Orabug: 37588023 8.2510.0-2.1 - Backport: imptcp: guard regex-framing match against iCurrLine == 0 Resolves: RHEL-212699...
SUSE SLES12: java-1_8_0-ibm / java-1_8_0-ibm-alsa / java-1_8_0-ibm-devel / etc (SUSE-SU-2026:4107-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4107-1 advisory. Update to Java 8.0 Service Refresh 8 Fix Pack 71 bsc1277833: - CVE-2026-8400: flaw in the ORB component may allow a malicious IIOP...