DEBIAN-CVE-2021-47478

In the Linux kernel, the following vulnerability has been resolved: isofs: Fix out of bound access for corrupted isofs image When isofs image is suitably corrupted isofsreadinode can read data beyond the end of buffer. Sanity-check the directory entry length before using it...

UBUNTU-CVE-2021-47478

In the Linux kernel, the following vulnerability has been resolved: isofs: Fix out of bound access for corrupted isofs image When isofs image is suitably corrupted isofsreadinode can read data beyond the end of buffer. Sanity-check the directory entry length before using it...

CVE-2024-26981

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix OOB in nilfssetdetype The size of the nilfstypebymode array in the fs/nilfs2/dir.c file is defined as "SIFMT SSHIFT", but the nilfssetdetype function, which uses this array, specifies the index to read from the array ...

DEBIAN-CVE-2024-26981

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix OOB in nilfssetdetype The size of the nilfstypebymode array in the fs/nilfs2/dir.c file is defined as "SIFMT SSHIFT", but the nilfssetdetype function, which uses this array, specifies the index to read from the array ...

SUSE CVE-2007-3961

Off-by-one error in the fspreaddirr function in fsplib.c in fsplib before 0.9 allows remote attackers to cause a denial of service via a directory entry whose length is exactly MAXNAMELEN, which prevents a terminating null byte from being added...

SUSE CVE-2015-2331

Integer overflow in the zipcdirnew function in zipdirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service application crash or possibly execute...

GSD-2022-1008167 ext4: fix BUG_ON() when directory entry has invalid rec_len

ext4: fix BUGON when directory entry has invalid reclen This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.224 by commit...

GSD-2022-1008078 ext4: fix BUG_ON() when directory entry has invalid rec_len

ext4: fix BUGON when directory entry has invalid reclen This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.154 by commit...

GSD-2022-1007964 ext4: fix BUG_ON() when directory entry has invalid rec_len

ext4: fix BUGON when directory entry has invalid reclen This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.78 by commit...

GSD-2022-1007808 ext4: fix BUG_ON() when directory entry has invalid rec_len

ext4: fix BUGON when directory entry has invalid reclen This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.8 by commit...

PT-2022-36219 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.78 Description: A potential issue exists in the ext4 file system, where a directory entry with an invalid rec len could trigger a BUG ON condition. The actual impact and attack plausibility of this issue...

PT-2022-36063 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.8 Description: The issue is related to the ext4 file system, where a directory entry with an invalid rec len can trigger a BUG ON condition. The actual impact and potential for exploitation have not been...

Hancom Office 2020 Hword HwordApp.dll SectorLoc heap-based buffer overflow

Summary A heap-based buffer overflow vulnerability exists in the Hword HwordApp.dll functionality of Hancom Office 2020 11.0.0.2353. A specially-crafted malformed file can lead to memory corruption and potential arbitrary code execution. An attacker can provide a malicious file to trigger this...

squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory and thus allows writing to locations outside of the destination.

...

ALPINE-CVE-2022-22844

LibTIFF 4.3.0 has an out-of-bounds read in TIFFmemcpy in tifunix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field...

UBUNTU-CVE-2022-22844

LibTIFF 4.3.0 has an out-of-bounds read in TIFFmemcpy in tifunix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field...

UBUNTU-CVE-2021-40153

squashfsopendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations...

Path traversal

squashfsopendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations...

SUSE: Security Advisory (SUSE-SU-2019:3263-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-25579

In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p7 msdosfs5 was failing to zero-fill a pair of padding fields in the dirent structure, resulting in a leak of three uninitialized bytes...