Linux kernel 竞争条件问题漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a Competitive Conditions Issue vulnerability, which stems from the presence of a competitive condition that could cause a local user to cause a system...

Null pointer dereference

Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjsgetptr. This vulnerability allows attackers to execute arbitrary code via a crafted input...

PT-2025-31032 · Unknown · Gix-Transport

Name of the Vulnerable Software and Affected Versions: gix-transport crate versions prior to 0.36.1 Description: The gix-transport crate contains a flaw that allows command execution through a crafted input string during a clone operation. Specifically, the vulnerability is triggered by the “gix...

CVE-2023-43338

Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjsgetptr. This vulnerability allows attackers to execute arbitrary code via a crafted input...

blurhash panics on parsing crafted inputs

Impact The blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include: - UTF-8 compliant strings containing multi-byte UTF-...

PT-2023-5877 · Delta Electronics · Diascreen

Name of the Vulnerable Software and Affected Versions: Delta Electronics DIAScreen affected versions not specified Description: The issue is related to a buffer overflow when parsing a specially crafted input file, which could allow an attacker to execute arbitrary code in the context of the...

phonenumber: panic on parsing crafted RF3966 phonenumber inputs

Impact The phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string .;phone-context=. Patches...

RUSTSEC-2023-0082 phonenumber: panic on parsing crafted RF3966 phonenumber inputs

Impact The phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string .;phone-context=. Patches...

CVE-2023-32611 G_variant_byteswap() can take a long time with some non-normal inputs

A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service...

netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way

A flaw was found in the Netty's netty-codec due to unrestricted chunk lengths in the SnappyFrameDecoder. By sending a specially-crafted input, a remote attacker could cause excessive memory usage resulting in a denial of service...

netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data

A flaw was found in Netty's netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service...

snappy-java: Unchecked chunk length leads to DoS

A flaw was found in Snappy-java's fileSnappyInputStream hasNextChunk function, which does not sufficiently evaluate input bytes before beginning operations. This issue could allow an attacker to send malicious input to trigger an out of memory error that crashes the program, resulting in a denial...

CVE-2023-36642

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the management interface of FortiTester 3.0.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...

PT-2023-25648 · Fortinet · Fortitester

Name of the Vulnerable Software and Affected Versions: FortiTester versions 3.0.0 through 7.2.3 Description: An improper neutralization of special elements used in an OS command vulnerability in the management interface may allow an authenticated attacker to execute unauthorized commands via...

Ubuntu 20.04 LTS / 22.04 LTS : FLAC vulnerability (USN-6360-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6360-1 advisory. It was discovered that FLAC incorrectly handled encoding certain files. A remote attacker could use this issue to cause FLAC to crash, resulting in a...

flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the encoder

A flaw was found in the libeconf library. This issue occurs due to a buffer overflow vulnerability in the bitwritergrow function in FLAC that allows remote attackers to run arbitrary code via crafted input to the encoder...

flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the encoder

A flaw was found in the libeconf library. This issue occurs due to a buffer overflow vulnerability in the bitwritergrow function in FLAC that allows remote attackers to run arbitrary code via crafted input to the encoder...

flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the encoder

A flaw was found in the libeconf library. This issue occurs due to a buffer overflow vulnerability in the bitwritergrow function in FLAC that allows remote attackers to run arbitrary code via crafted input to the encoder...

flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the encoder

A flaw was found in the libeconf library. This issue occurs due to a buffer overflow vulnerability in the bitwritergrow function in FLAC that allows remote attackers to run arbitrary code via crafted input to the encoder...

libvips Code Issues Vulnerabilities

libvips is an open source 2D image processing library. A code issue vulnerability exists in libvips 8.14.3 and earlier versions, which stems from an attempt to parse misformatted UTF-8 characters, where an attacker can cause a segmentation error in libvips via specially crafted SVG input...