267 matches found
SUSE CVE-2024-42306
In the Linux kernel, the following vulnerability has been resolved: udf: Avoid using corrupted block bitmap buffer When the filesystem block bitmap is corrupted, we detect the corruption while loading the bitmap and fail the allocation with error. However the next allocation from the same bitmap...
kernel: udf: Fix NULL pointer dereference in udf_symlink function
A vulnerability was found in the Linux kernel's UDF file system driver, where the udfsymlink function can dereference a NULL pointer. This occurs because the function uses a value returned from udftgetblk without checking if it is NULL, potentially causing system crashes if sbgetblk fails...
IOAESAccelerator Component Privilege Escalation
The vulnerability of the IOAESAccelerator component in the UDF file system of the Mac OS operating system is related to operations that go beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...
UBUNTU-CVE-2021-47353
In the Linux kernel, the following vulnerability has been resolved: udf: Fix NULL pointer dereference in udfsymlink function In function udfsymlink, epos.bh is assigned with the value returned by udftgetblk. The function udftgetblk is defined in udf/misc.c and returns the value of sbgetblk functi...
kernel: NULL pointer dereference in udf_expand_file_adinicbdue() during writeback
A NULL pointer dereference was found in the Linux kernel’s UDF file system functionality in the way the user triggers the udffilewriteiter function for a malicious UDF image. This flaw allows a local user to crash the system...
UBUNTU-CVE-2023-37454
An issue was discovered in the Linux kernel through 6.4.2. A crafted UDF filesystem image causes a use-after-free write operation in the udfputsuper and udfcloselvid functions in fs/udf/super.c. NOTE: the suse.com reference has a different perspective about this...
SUSE CVE-2010-2237
Red Hat libvirt, possibly 0.6.1 through 0.8.2, looks up disk backing stores without referring to the user-defined main disk format, which might allow guest OS users to read arbitrary files on the host OS, and possibly have unspecified other impact, via unknown vectors...
SUSE CVE-2014-6410
The udfreadinode function in fs/udf/inode.c in the Linux kernel through 3.16.3 does not restrict the amount of ICB indirection, which allows physically proximate attackers to cause a denial of service infinite loop or stack consumption via a UDF filesystem with a crafted inode...
CVE-2022-1943
...
PT-2025-37900
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel where the file length of an inline file was incorrectly updated even when a write operation failed or only partially succeeded. This occurred because th...
Linux UDF File System Code Execution
The vulnerability of the UDF file system functionality in Linux operating systems is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
PT-2025-40213
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue where merging very long extents could lead to corruption of extents within a file. The problem stemmed from unnecessarily complex logic when attempting...
PT-2024-11817
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the Universal Disk Format UDF in the Linux kernel, where a problem with preallocation discarding at indirect extent boundaries could lead to corruption of the...
kernel: NULL pointer dereference in udf_expand_file_adinicbdue() during writeback
A NULL pointer dereference was found in the Linux kernel’s UDF file system functionality in the way the user triggers the udffilewriteiter function for a malicious UDF image. This flaw allows a local user to crash the system...
kernel: NULL pointer dereference in udf_expand_file_adinicbdue() during writeback
A NULL pointer dereference was found in the Linux kernel’s UDF file system functionality in the way the user triggers the udffilewriteiter function for a malicious UDF image. This flaw allows a local user to crash the system...
UBUNTU-CVE-2022-1943
A flaw out of bounds memory write in the Linux kernel UDF file system functionality was found in the way user triggers some file operation which triggers udfwritefi. A local user could use this flaw to crash the system or potentially...
USN-5385-1 linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, inux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux-snapdragon vulnerabilities
Brendan Dolan-Gavitt discovered that the aQuantia AQtion Ethernet device driver in the Linux kernel did not properly validate meta-data coming from the device. A local attacker who can control an emulated device can use this to cause a denial of service system crash or possibly execute arbitrary...
edk2: Buffer overflows in PartitionDxe and UdfDxe with long file names and invalid UDF media
Buffer overflows were discovered in UDF-related codes under MdeModulePkg\Universal\Disk\PartitionDxe\Udf.c and MdeModulePkg\Universal\Disk\UdfDxe, which could be triggered with long file names or invalid formatted UDF media...
edk2: Buffer overflows in PartitionDxe and UdfDxe with long file names and invalid UDF media
Buffer overflows were discovered in UDF-related codes under MdeModulePkg\Universal\Disk\PartitionDxe\Udf.c and MdeModulePkg\Universal\Disk\UdfDxe, which could be triggered with long file names or invalid formatted UDF media...
FreeBSD : p7zip -- out-of-bounds read vulnerability (d706a3a3-4a7c-11e6-97f7-5453ed2e2b49)
Cisco Talos reports : An out-of-bounds read vulnerability exists in the way 7-Zip handles Universal Disk Format UDF files. Central to 7-Zip's processing of UDF files is the CInArchive::ReadFileItem method. Because volumes can have more than one partition map, their objects are kept in an object...