Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation

Summary When using the Vault and Vault Enterprise Vault approle auth method, any authenticated user with access to the /auth/approle/role/:rolename/secret-id-accessor/destroy endpoint can destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability, CVE-2023-249...

CVE-2023-24999: Incorrect Authorization

HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above...

In nf_tables_updtable if nf_tables_table_enable returns an error nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del() but the transaction was never placed on a list -- the list head is all zeroes this results in a NULL pointer dereference.

...

Vulnerability of the j1939_sessiondestroy() function in the net/can/j1939/transport.c module: a flaw in Linux operating system kernel-based IPsec components, allowing an attacker to cause a service failure.

The vulnerability of the j1939sessiondestroy function in the net/can/j1939/transport.c module is related to incorrect handling of block usage counters in IPsec components of the Linux operating system. Exploiting this vulnerability could allow a remote attacker to cause service failures...

DEBIAN-CVE-2023-1095

In nftablesupdtable, if nftablestableenable returns an error, nfttransdestroy is called to free the transaction object. nfttransdestroy calls listdel, but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference...

UBUNTU-CVE-2023-1095

In nftablesupdtable, if nftablestableenable returns an error, nfttransdestroy is called to free the transaction object. nfttransdestroy calls listdel, but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference...

PT-2025-54089

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's CIFS implementation where a Server Message Block SMB direct connection's information could be leaked if memory allocation MR allocate failed...

libucl:ucl_add_string_fuzzer: Heap-buffer-overflow in ucl_object_dtor_unref_single

Detailed Report: https://oss-fuzz.com/testcase?key=5536581680496640 Project: libucl Fuzzing Engine: libFuzzer Fuzz Target: ucladdstringfuzzer Job Type: libfuzzerasanlibucl Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x602000000ed0 Crash State: uclobjectdtorunrefsingl...

SUSE CVE-2008-5029

The scmdestroy function in net/core/scm.c in the Linux kernel 2.6.27.4, 2.6.26, and earlier makes indirect recursive calls to itself through calls to the fput function, which allows local users to cause a denial of service panic via vectors related to sending an SCMRIGHTS message through a UNIX...

SUSE CVE-2010-1168

The Safe aka Safe.pm module before 2.25 for Perl allows context-dependent attackers to bypass intended 1 Safe::reval and 2 Safe::rdo access restrictions, and inject and execute arbitrary code, via vectors involving implicitly called methods and implicitly blessed objects, as demonstrated by the a...

SUSE CVE-2015-7577

activerecord/lib/activerecord/nestedattributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, which allows remote attackers to bypass...

SUSE CVE-2016-1647

Use-after-free vulnerability in the RenderWidgetHostImpl::Destroy function in content/browser/rendererhost/renderwidgethostimpl.cc in the Navigation implementation in Google Chrome before 49.0.2623.108 allows remote attackers to cause a denial of service or possibly have unspecified other impact...

SUSE CVE-2016-7413

Use-after-free vulnerability in the wddxstackdestroy function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a wddxPacket XML document that lacks an end-tag for a recordset field...

SUSE CVE-2016-8887

The jp2colrdestroy function in libjasper/jp2/jp2cod.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service NULL pointer dereference...

SUSE CVE-2016-10250

The jp2colrdestroy function in jp2cod.c in JasPer before 1.900.13 allows remote attackers to cause a denial of service NULL pointer dereference by leveraging incorrect cleanup of JP2 box data on error. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8887...

SUSE CVE-2017-8359

Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpccalldestroy function in core/lib/surface/call.c...

SUSE CVE-2018-6836

The netmonreccommentdestroy function in wiretap/netmon.c in Wireshark through 2.4.4 performs a free operation on an uninitialized memory address, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact...

SUSE CVE-2018-7435

An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the freexl::destroycell function...

SUSE CVE-2019-6455

An issue was discovered in GNU Recutils 1.8. There is a double-free problem in the function recmsetelemdestroy in the file rec-mset.c...

SUSE CVE-2019-17541

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c...