101820 matches found
DEBIAN-CVE-2026-104074
Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stuniniterrorresponsecommonstr function in src/client/nsturnmsg.c,...
UBUNTU-CVE-2026-104074
Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stuniniterrorresponsecommonstr function in src/client/nsturnmsg.c,...
CVE-2026-104074
Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stuniniterrorresponsecommonstr function in src/client/nsturnmsg.c,...
CVE-2026-104074 Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODE
Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. Attackers can exploit the stuniniterrorresponsecommonstr function in src/client/nsturnmsg.c,...
CVE-2026-15894
The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In solpdudecrypt, out is allocated as NETBUFSIMPLE17 and then filled with...
CVE-2026-15894
The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In solpdudecrypt, out is allocated as NETBUFSIMPLE17 and then filled with...
CVE-2026-15894 Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement
The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In solpdudecrypt, out is allocated as NETBUFSIMPLE17 and then filled with...
CVE-2026-15894 Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement
The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In solpdudecrypt, out is allocated as NETBUFSIMPLE17 and then filled with...
EUVD-2026-94230
The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In solpdudecrypt, out is allocated as NETBUFSIMPLE17 and then filled with...
CVE-2026-15894
The Zephyr RTOS Bluetooth Mesh stack is vulnerable to a stack-based buffer overflow in the On-Demand Private Proxy solicitation handler (subsys/bluetooth/mesh/solicitation.c). The sol_pdu_decrypt() function copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the ...
CVE-2026-15894 Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement
The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In solpdudecrypt, out is allocated as NETBUFSIMPLE17 and then filled with...
kernel: Bluetooth: MGMT: validate LTK enc_size on load
A flaw was found in the Linux kernel's Bluetooth management MGMT component. An attacker could exploit a vulnerability in how Long Term Keys LTK are loaded. By providing an oversized encryption size, a stack buffer overflow can occur, potentially leading to a denial of service...
kernel: netfilter: conntrack: remove sprintf usage
A flaw was found in the Linux kernel's netfilter conntrack module. This vulnerability arises from the use of sprintf and insufficient buffer sizing in the manglecontentlen function, which can lead to a stack-out-of-bounds write. An attacker could potentially exploit this memory corruption issue t...
kernel: i2c: stub: Reject I2C block transfers with invalid length
A flaw was found in the Linux kernel's i2c-stub driver. A local user with access to the /dev/i2c- device can exploit this vulnerability by issuing an I2C System Management Bus SMBus input/output control ioctl command with a specially crafted block transfer length. This invalid length can cause th...
CVE-2026-59347
VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. Affected versions: - VMware...
CVE-2026-59347 VMware Workstation and Fusion HGFS stack-based buffer-overflow vulnerability
VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. Affected versions: - VMware...
EUVD-2026-94169
VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. Affected versions: - VMware...
CVE-2026-59347
VMware Workstation and VMware Fusion are affected by a stack-based buffer-overflow vulnerability in the HGFS component. A malicious actor with local administrative privileges on a virtual machine can exploit this issue to execute arbitrary code as the virtual machine's VMX process running on the ...
Moderate: Red Hat Security Advisory: glibc security update
An update for glibc is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion
A flaw was found in glibc. When processing paths that start with a tilde followed by a username, the wordexp function can be forced to allocate an excessive amount of memory on the program's stack. A remote attacker could exploit this by providing a very long username, leading to a stack exhausti...