CVE-2024-41593: Out-of-bounds Write

DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ftpayloaddns, because a byte sign-extension operation occurs for the length argument of a memcpy call, leading to a heap-based Buffer Overflow...

CVE-2024-41593

CVE-2024-41593 affects DrayTek Vigor310 devices up to version 4.3.2.6. The vulnerability is a heap-based buffer overflow in the web interface function ft_payload_dns due to a byte sign-extension in the length argument of a memcpy call, enabling remote code execution. Connected sources confirm the...

The vulnerability of the `cv::RLByteStream::getBytes` function in the modules/imgcodecs/src/bitstrm.cpp component of the OpenCV library, which is used for computer vision, image processing, and general numerical algorithms, allows a hacker to gain access to confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of the cv::RLByteStream::getBytes function in the modules/imgcodecs/src/bitstrm.cpp file of the OpenCV library, which is used for computer vision, image processing, and numerical algorithms in general-purpose open-source computer vision libraries, relates to buffer overflow...

CVE-2024-46853

In the Linux kernel, the following vulnerability has been resolved: spi: nxp-fspi: fix the KASAN report out-of-bounds bug Change the memcpy length to fix the out-of-bounds issue when writing the data that is not 4 byte aligned to TX FIFO. To reproduce the issue, write 3 bytes data to NOR chip. dd...

AZL-49983 CVE-2024-46853 affecting package kernel for versions less than 5.15.176.3-1

In the Linux kernel, the following vulnerability has been resolved: spi: nxp-fspi: fix the KASAN report out-of-bounds bug Change the memcpy length to fix the out-of-bounds issue when writing the data that is not 4 byte aligned to TX FIFO. To reproduce the issue, write 3 bytes data to NOR chip. dd...

kernel: nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells

In the Linux kernel, the following vulnerability has been resolved: nvmem: Fix shift-out-of-bound UBSAN with byte size cells If a cell has 'nbits' equal to a multiple of BITSPERBYTE the logic p &= GENMASKcell-nbits%BITSPERBYTE - 1, 0; will become undefined behavior because nbits modulo BITSPERBYT...

kernel: nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells

In the Linux kernel, the following vulnerability has been resolved: nvmem: Fix shift-out-of-bound UBSAN with byte size cells If a cell has 'nbits' equal to a multiple of BITSPERBYTE the logic p &= GENMASKcell-nbits%BITSPERBYTE - 1, 0; will become undefined behavior because nbits modulo BITSPERBYT...

sqlite3: heap-buffer-overflow in sqlite3Utf16ByteLen

With the following new fuzz target generated by https://github.com/google/oss-fuzz-gen: include "/src/sqlite3/bld/sqlite3.h" include include include extern "C" int LLVMFuzzerTestOneInputconst uint8t data, sizet size sqlite3 db; if sqlite3open":memory:", &db != SQLITEOK return 0; // Use size...

CVE-2024-46764

In the Linux kernel, the following vulnerability has been resolved: bpf: add check for invalid name in btfnamevalidsection If the length of the name string is 1 and the value of name0 is NULL byte, an OOB vulnerability occurs in btfnamevalidsection and the return value is true, so the invalid nam...

DEBIAN-CVE-2024-46764

In the Linux kernel, the following vulnerability has been resolved: bpf: add check for invalid name in btfnamevalidsection If the length of the name string is 1 and the value of name0 is NULL byte, an OOB vulnerability occurs in btfnamevalidsection and the return value is true, so the invalid nam...

UBUNTU-CVE-2024-46764

In the Linux kernel, the following vulnerability has been resolved: bpf: add check for invalid name in btfnamevalidsection If the length of the name string is 1 and the value of name0 is NULL byte, an OOB vulnerability occurs in btfnamevalidsection and the return value is true, so the invalid nam...

CVE-2024-46729 drm/amd/display: Fix incorrect size calculation for loop

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix incorrect size calculation for loop WHY feclken has size of 5 but sizeoffeclken has byte size 20 which is lager than the array size. HOW Divide byte size 20 by its element size. This fixes 2 OVERRUN issues...

CVE-2024-46764: Out-of-bounds Read

In the Linux kernel, the following vulnerability has been resolved: bpf: add check for invalid name in btfnamevalidsection If the length of the name string is 1 and the value of name0 is NULL byte, an OOB vulnerability occurs in btfnamevalidsection and the return value is true, so the invalid nam...

openbabel: global-buffer-overflow in OpenBabel::generate_sequence

With the following new fuzz target: include include include include include "/src/openbabel/include/openbabel/inchiformat.h" include "/src/openbabel/include/openbabel/format.h" // Fixed line include extern "C" int LLVMFuzzerTestOneInputconst uint8t Data, sizet Size using namespace std; using...

libyang: heap-buffer-overflow in lyd_lyb_data_length

With the following auto-generated fuzz target: include "/src/libyang/src/treedata.h" include include int LLVMFuzzerTestOneInputconst uint8t data, sizet size if !size return 0; const char dataptr = const char data; // Ensure the data is null-terminated. char nullterminateddata = mallocsize + 1; if...

An issue was discovered in the rand_core crate before 0.4.2 for Rust. Casting of byte slices to integer slices mishandles alignment constraints.

...

pjsip: Heap-buffer-overflow in pjmedia_rtcp_fb_parse_rpsi

With the new following fuzz target: include "/src/pjsip/pjmedia/include/pjmedia/rtcpfb.h" include include int LLVMFuzzerTestOneInputconst uint8t data, sizet size if size & /src/llvm-project/compiler-r...

pjsip: Heap-buffer-overflow in pjmedia_rtcp_fb_parse_sli

With the new following fuzz target: include "/src/pjsip/pjmedia/include/pjmedia/rtcpfb.h" include include include int LLVMFuzzerTestOneInputconst uint8t data, sizet size // pjmediartcpfbcommon doesn't have a 'length' member. // We need to ensure enough data for the header at least if size =...

pjsip: Heap-buffer-overflow in pjmedia_rtcp_fb_parse_sli

With the new following fuzz target: include "/src/pjsip/pjmedia/include/pjmedia/rtcpfb.h" include include include int LLVMFuzzerTestOneInputconst uint8t data, sizet size // pjmediartcpfbcommon doesn't have a 'length' member. // We need to ensure enough data for the header at least if size =...

SUSE CVE-2024-8235

A flaw was found in libvirt. A refactor of the code fetching the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer. This corner case would lead to a NULL-pointer dereference and subsequent crash of virtinterface...