Exploitable heap overflow vulnerability exists in Ruby's Psych::Emitter start_document function

An exploitable heap overflow vulnerability exists in the Psych::Emitter startdocument function of Ruby. In Psych::Emitter startdocument function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array...

SUSE SLES12: libsqlite3-0 / libsqlite3-0-32bit / sqlite3 / sqlite3-devel / etc (SUSE-SU-2022:3401-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3401-1 advisory. Security issues fixed: - CVE-2022-35737: Fixed an array-bounds overflow if billions of bytes are used in a string argument to a C A...

SUSE: Security Advisory (SUSE-SU-2022:3401-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Wrong value returned in numValidators() function

Lines of code Vulnerability details Impact wrong value returned by numValidators . Proof of Concept The function numValidators is meant to return the number o validators. if clearValidatorArray is called the validators array will be cleared but the length will still be the same. The function...

PT-2025-41049

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the xhci alloc stream info function within the USB host controller interface of the Linux kernel. The function allocates memory for a stream context array but fai...

PT-2022-24827 · Unknown · Parse Server

Name of the Vulnerable Software and Affected Versions: Parse Server versions prior to 4.10.16 Parse Server versions 5.0.0 through 5.2.6 Description: The issue concerns the validation of the authentication adapter app ID for Facebook and Spotify. In affected configurations, where the appIds is set...

openSUSE: Security Advisory for sqlite3 (SUSE-SU-2022:3307-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE SLED15: libsqlite3-0 / libsqlite3-0-32bit / sqlite3 / sqlite3-devel / etc (SUSE-SU-2022:3307-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3307-1 advisory. Security issues fixed: - CVE-2022-35737: Fixed an array-bounds overflow if billions of bytes are...

SUSE: Security Advisory (SUSE-SU-2022:3307-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GSD-2022-1005734 bpf: Don't use tnum_range on array range checking for poke descriptors

bpf: Don't use tnumrange on array range checking for poke descriptors This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.140 by commit...

GSD-2022-1005711 hwmon: (gpio-fan) Fix array out of bounds access

hwmon: gpio-fan Fix array out of bounds access This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.142 by commit...

PT-2022-33969 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.142 Description: The issue concerns an array out of bounds access in the gpio-fan component of the Linux Kernel's hwmon subsystem. The actual impact and potential for attack have not been proven yet...

PT-2022-33992

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.140 Description The issue concerns array range checking for poke descriptors in the bpf module. It was introduced in version v5.5 and fixed in version v5.10.140. The actual impact and attack plausibility ha...

GSD-2022-1005281 bpf: fix potential 32-bit overflow when accessing ARRAY map element

bpf: fix potential 32-bit overflow when accessing ARRAY map element This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.2 by commit...

GSD-2022-1004969 hwmon: (gpio-fan) Fix array out of bounds access

hwmon: gpio-fan Fix array out of bounds access This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.8 by commit...

CVE-2022-25690

Information disclosure in WLAN due to improper validation of array index while parsing crafted ANQP action frames in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile,...

CVE-2022-25690

Information disclosure in WLAN due to improper validation of array index while parsing crafted ANQP action frames in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile,...

CVE-2022-25690

CVE-2022-25690 corresponds to information disclosure in Qualcomm’s WLAN stack due to improper validation of array indices while parsing crafted ANQP action frames. The connected PT-2022-4878 entry details Qualcomm Snapdragon family components (Snapdragon Auto, Compute, Connectivity, and various S...

PT-2022-33539

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.19.2 Description The issue concerns a potential 32-bit overflow when accessing an ARRAY map element in the bpf. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

PT-2022-33227 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.8 Description: The issue concerns an array out of bounds access in the gpio-fan component of the Linux Kernel. This problem was introduced in version v4.1 and is fixed in version v5.19.8. The actual impact...