15 matches found
CVE-2026-42495
The Xen hypervisor is vulnerable to a numerical overflow within the libfsimage library's iso9660 driver . The vulnerability occurs because the driver derives lengths directly from attacker-controlled on-disk fields without proper validation, specifically during the calculation of the System Use a...
CVE-2026-62425 buffer overruns in libfsimage iso9660 handling
This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...
CVE-2026-63892
CVE-2026-63892 affects the Linux kernel thunderbolt property parsing. The non-root path in __tb_property_parse_dir() may read beyond the end of a property block when entry->length length and the code copies 4 dwords from dir_offset regardless of dir_len. This creates two OOB conditions: (1) a ...
CVE-2026-27711 NanaZip UFS Archive Parser Memory Corruption via Unvalidated Directory Record Length
NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, a memory corruption vulnerability in NanaZip’s UFS parser allows a crafted .ufs/.ufs2/.img file to trigger out-of-bounds memory access during archive open/listing. The bug is...
CVE-2026-27711 NanaZip UFS Archive Parser Memory Corruption via Unvalidated Directory Record Length
NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, a memory corruption vulnerability in NanaZip’s UFS parser allows a crafted .ufs/.ufs2/.img file to trigger out-of-bounds memory access during archive open/listing. The bug is...
curl FTP path confusion leads to NIL byte out of bounds write
curl can be coerced into writing a zero byte out of bounds. This bug can trigger when curl is told to work on an FTP URL, with the setting to only issue a single CWD command --ftp-method singlecwd or the libcurl alternative CURLOPTFTPFILEMETHOD. curl then URL-decodes the given path, calls strlen ...
GHSA-674J-7M97-J2P9 curl FTP path confusion leads to NIL byte out of bounds write
curl can be coerced into writing a zero byte out of bounds. This bug can trigger when curl is told to work on an FTP URL, with the setting to only issue a single CWD command --ftp-method singlecwd or the libcurl alternative CURLOPTFTPFILEMETHOD. curl then URL-decodes the given path, calls strlen ...
Debian DLA-1275-1 : uwsgi security update
It was discovered that the uwsgiexpandpath function in utils.c in Unbit uWSGI, an application container server, has a stack-based buffer overflow via a large directory length that can cause a denial of service application crash or stack corruption. For Debian 7 'Wheezy', these problems have been...
CVE-2018-6758
The uwsgiexpandpath function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length...
ALPINE-CVE-2018-6758
The uwsgiexpandpath function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length...
CVE-2018-6758
The uwsgiexpandpath function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length...
UBUNTU-CVE-2018-6758
The uwsgiexpandpath function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length...
CVE-2018-6758
The uwsgiexpandpath function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length...