325538 matches found
gvfs: SFTP: heap-based buffer overflow in read_reply()
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing...
EUVD-2026-105034
The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time. A PNG carries exactly one IHDR and it is the first chunk. A file that places a second one aft...
Important: Red Hat Security Advisory: openssl security update
An update for openssl is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabili...
openssl: heap buffer overflow in CMS key unwrapping
A flaw was found in OpenSSL. A crafted CMS Cryptographic Message Syntax message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMSdecrypt. This issue occurs because the CMS decryption process incorrectly sizes the key-unwrap output buffer when using the AES-WRAP-PAD unwrap...
CVE-2026-96402 USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle count
A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page...
CVE-2026-96402
The USBX host class is vulnerable to an out-of-bounds read (CWE-125) within its PIMA/MTP implementation. A malicious USB MTP/PTP device can trigger this vulnerability during ordinary object enumeration by over-reporting its object handle count. This causes the host to read past its heap receive b...
EUVD-2026-105024
A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page...
CLSA-2026-1791337488 php: Fix of 10 CVEs
CVE-2025-14181: fix heap buffer overflow in the SOAP HTTP client chunked response handling GHSA-cj93-vc83-wgqv - CVE-2026-92842: fix heap over-read in convert stream filters with NUL in line-break-chars GHSA-88hq-2827-7pg6 - CVE-2026-93682: fix out-of-bounds read on an empty Location header in...
gvfs: SFTP: heap-based buffer overflow in read_reply()
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing...
Important: Red Hat Security Advisory: gvfs security update
An update for gvfs is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...
Important: Red Hat Security Advisory: gvfs security update
An update for gvfs is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
gvfs: SFTP: heap-based buffer overflow in read_reply()
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing...
Important: Red Hat Security Advisory: gvfs security update
An update for gvfs is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...
gvfs: SFTP: heap-based buffer overflow in read_reply()
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing...
gvfs: SFTP: heap-based buffer overflow in read_reply()
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing...
Important: Red Hat Security Advisory: gvfs security update
An update for gvfs is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...
CVE-2026-93077
A flaw was found in the Linux kernel's cxl/features component. The cxlgetfeature function, when reading feature data, uses a fixed output buffer size in a loop. This can lead to a buffer overflow if a connected device returns more data than the remaining buffer capacity, potentially allowing for...
CVE-2026-93067
A flaw was found in the Linux kernel's drm/bridge: tc358767 component. An issue in the tcauxtransfer function, specifically within tcauxreaddata, allows a connected DisplayPort DP AUX controller to report a read size larger than requested. This can lead to a buffer overflow when reading data into...
CVE-2026-93063
A flaw was found in the Linux kernel's iwlwifi component. This vulnerability allows an attacker to cause a buffer overflow by sending a specially crafted Service Advertisement Protocol SAP message that exceeds the allocated buffer size. This could lead to memory corruption, potentially causing th...
gstreamer:gst-audioparsers: Heap-buffer-overflow in gst_mpeg_audio_parse_handle_frame
Project: https://anongit.freedesktop.org/git/gstreamer/gstreamer https://gitlab.freedesktop.org/gstreamer/gstreamer.git Detailed Report: https://oss-fuzz.com/testcase?key=6135543096999936 Project: gstreamer Fuzzing Engine: libFuzzer Fuzz Target: gst-audioparsers Job Type: libfuzzerasangstreamer...