323210 matches found
CVE-2026-11771
OpenVPN vulnerability CVE-2026-11771 affects OpenVPN versions 2.1.0–2.6.20 and 2.7_alpha1–2.7.4. Root cause: an off-by-one buffer write in the NTLM proxy authentication handling, which can be triggered by a crafted NTLM response from a malicious proxy server. Impact: potential crash of the OpenVP...
CVE-2026-11771
OpenVPN version 2.1.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server...
SUSE CVE-2026-59250
Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory and potentially achieve remote code execution or a denial-of-service crash by sending a single text-encoded H.248/Megaco message containing an oversized...
GHSA-4MRV-5P47-P938 MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
Summary MessagePack::Bufferclear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor rmemlast, rmemend, rmemowner. The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has...
MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
Summary MessagePack::Bufferclear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor rmemlast, rmemend, rmemowner. The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has...
CVE-2026-54522 MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Bufferclear in ext/msgpack/buffer.c leaves rmemlast, rmemend, and rmemowner stale after msgpackbuffershiftchunk returns an rmem page to the shared pool, allowing a subsequent...
CVE-2026-54522 MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Bufferclear in ext/msgpack/buffer.c leaves rmemlast, rmemend, and rmemowner stale after msgpackbuffershiftchunk returns an rmem page to the shared pool, allowing a subsequent...
CVE-2026-54522
CVE-2026-54522 affects MessagePack for Ruby prior to 1.8.2, where MessagePack::Buffer#clear can leave internal rmem pointers stale after a chunk return, enabling a subsequent Buffer#write to alias the freed page and potentially disclose or corrupt cross-buffer data. Root cause: stale rmem_last/rm...
CVE-2026-54522 MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Bufferclear in ext/msgpack/buffer.c leaves rmemlast, rmemend, and rmemowner stale after msgpackbuffershiftchunk returns an rmem page to the shared pool, allowing a subsequent...
CVE-2026-54522
MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Bufferclear in ext/msgpack/buffer.c leaves rmemlast, rmemend, and rmemowner stale after msgpackbuffershiftchunk returns an rmem page to the shared pool, allowing a subsequent...
SUSE CVE-2026-64558
In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkeypckmo handler implementation Explicitly check the length of the target buffer in the pkeypckmo implementation of the keytoprotkey handler function. The handler function fails, if the generated outpu...
SUSE CVE-2026-64559
In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEYVERIFYPROTK ioctl Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size...
JLSEC-2026-954 ImageMagick: Stack buffer overflow in FTXT reader via oversized integer field
Summary A stack-based buffer overflow exists in the ImageMagick FTXT image reader. A crafted FTXT file can cause out-of-bounds writes on the stack, leading to a crash. ================================================================= ==3537074==ERROR: AddressSanitizer: stack-buffer-overflow on...
JLSEC-2026-957 ImageMagick Has Signed Integer Overflow in SIXEL Decoder, Leading to Memory Corruption
A signed integer overflow vulnerability in ImageMagick's SIXEL decoder allows an attacker to trigger memory corruption and denial of service when processing a maliciously crafted SIXEL image file. The vulnerability occurs during buffer reallocation operations where pointer arithmetic using signed...
JLSEC-2026-925 ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow
Summary A 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytesperline stride to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the overflowed stride, so the first row immediately writes...
JLSEC-2026-1043 ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex...
ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache updating image channel metadata before pixel cache memory allocation. Attackers can trigger memory and disk allocation failures to cause a heap-buffer-overflow read affecting a...
JLSEC-2026-951 ImageMagick has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer
The UIL and XPM image encoder do not validate the pixel index value returned by GetPixelIndex before using it as an array subscript. In HDRI builds, Quantum is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger ...
JLSEC-2026-1082
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check for an end-of-file in every location so a crafted image could result in an heap buffer over-read. This issue has been fixed in version...
CVE-2026-58216
An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of th...