DEBIAN-CVE-2026-59646

In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bctls-fips 1.0.24 1.0.X series, 2.0.24 2.0.X series and 2.1.24 2.1.X...

UBUNTU-CVE-2026-59646

In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bctls-fips 1.0.24 1.0.X series, 2.0.24 2.0.X series and 2.1.24 2.1.X...

PT-2026-67239

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS BC-FJA bctls-fips versions prior to 1.0.24 Bouncy Castle for Java FIPS BC-FJA bctls-fips versions prior to 2.0.24...

Linux Distros Unpatched Vulnerability : CVE-2026-67303

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.29.0 contains a reachable assertion WINPRASSERTOutputBufferLength == BytesReturned in serialprocessirpdevicecontrol in...

CVE-2026-67303

FreeRDP before 3.29.0 contains a reachable assertion WINPRASSERTOutputBufferLength == BytesReturned in serialprocessirpdevicecontrol in channels/serial/client/serialmain.c. When serial device redirection is enabled and a server-controlled IRPMJDEVICECONTROL request specifies an unsupported IOCTL...

CVE-2026-67303

FreeRDP vulnerability CVE-2026-67303 affects FreeRDP before 3.29.0. When serial device redirection is enabled and a server-controlled IRP_MJ_DEVICE_CONTROL request specifies an unsupported IOCTL with a non-zero OutputBufferLength, CommDeviceIoControl() can fail with BytesReturned = 0. This mismat...

CVE-2026-67303

FreeRDP before 3.29.0 contains a reachable assertion WINPRASSERTOutputBufferLength == BytesReturned in serialprocessirpdevicecontrol in channels/serial/client/serialmain.c. When serial device redirection is enabled and a server-controlled IRPMJDEVICECONTROL request specifies an unsupported IOCTL...

CVE-2026-67303 FreeRDP before 3.29.0 Denial of Service via serial DeviceControl

FreeRDP before 3.29.0 contains a reachable assertion WINPRASSERTOutputBufferLength == BytesReturned in serialprocessirpdevicecontrol in channels/serial/client/serialmain.c. When serial device redirection is enabled and a server-controlled IRPMJDEVICECONTROL request specifies an unsupported IOCTL...

SUSE CVE-2026-64558

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkeypckmo handler implementation Explicitly check the length of the target buffer in the pkeypckmo implementation of the keytoprotkey handler function. The handler function fails, if the generated outpu...

SUSE CVE-2026-64559

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEYVERIFYPROTK ioctl Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size...

CVE-2026-64558

A flaw was found in the Linux kernel, specifically within the s390/pkey component. This vulnerability occurs because the pkeypckmo handler function does not explicitly check the length of the target buffer. If the generated output data exceeds the provided buffer's length, the handler function...

CVE-2026-64559

A flaw was found in the Linux kernel. A missing buffer length check in the PKEYVERIFYPROTK ioctl within the s390/pkey module allows a local attacker to provide a buffer length request that exceeds the allocated buffer size. This could lead to information disclosure by reading out-of-bounds memory...

CVE-2026-64559

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEYVERIFYPROTK ioctl Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size...

CVE-2026-64559

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEYVERIFYPROTK ioctl Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size...

CVE-2026-64559 s390/pkey: Check length in PKEY_VERIFYPROTK ioctl

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEYVERIFYPROTK ioctl Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size...

CVE-2026-64559 s390/pkey: Check length in PKEY_VERIFYPROTK ioctl

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEYVERIFYPROTK ioctl Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size...

CVE-2026-64559

The CVE-2026-64559 entry concerns the Linux kernel s390/pkey module, where a missing buffer length check in the PKEY_VERIFYPROTK ioctl allowed a local attacker to provide a request length that exceeded the allocated buffer. The available documents confirm the root cause is a length verification o...

EUVD-2026-50406

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEYVERIFYPROTK ioctl Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size...

CVE-2026-64558

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkeypckmo handler implementation Explicitly check the length of the target buffer in the pkeypckmo implementation of the keytoprotkey handler function. The handler function fails, if the generated outpu...

CVE-2026-64558 s390/pkey: Check length in pkey_pckmo handler implementation

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkeypckmo handler implementation Explicitly check the length of the target buffer in the pkeypckmo implementation of the keytoprotkey handler function. The handler function fails, if the generated outpu...