434 matches found
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...
CVE-2026-62432
The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer...
UBUNTU-CVE-2026-62432
The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer...
CVE-2026-62432
The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer...
CVE-2026-62432
CVE-2026-62432: The EVTCHNOP_expand_array hypercall in Xen signals a race with EVTCHNOP_reset when checking FIFO event channels, because the correct lock is not held, leading to potential dereference of a NULL pointer. Affected: Xen hypervisor interfaces referenced in the NVD entry and mirrored i...
CVE-2026-62432 evtchn: Race between FIFO expand and reset
The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer...
CVE-2026-62432
The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer...
EUVD-2026-49785
The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer...
CVE-2026-62432 evtchn: Race between FIFO expand and reset
The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer...
PT-2026-65474
The EVTCHNOP expand array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP reset, resulting in dereferencing a NULL pointer...
brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function
A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand function, which can lead to excessive memory consumption. This can cause a denial of service DoS by crashing the application due to an out-of-memory error...
brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function
A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand function, which can lead to excessive memory consumption. This can cause a denial of service DoS by crashing the application due to an out-of-memory error...
brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function
A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand function, which can lead to excessive memory consumption. This can cause a denial of service DoS by crashing the application due to an out-of-memory error...
Oracle Linux 10 : plexus-utils (ELSA-2026-38514)
The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-38514 advisory. 3.5.1-9 - Fix CVE-2025-67030: Directory Traversal in Expand.extractFile Resolves: RHEL-165336 Tenable has extracted the preceding description block directly...
GHSA-XJ96-63GP-2GMR Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
Summary Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size. Minimal public API trigger: python from PIL import Image, ImageFilter im = Image.new"L", 3, 3, 128 im.filterImageFilter.MedianFilter4294967295 ImageFilter.RankFilter.filt...
plexus-utils security update
3.3.0-14 - Fix CVE-2025-67030: Directory Traversal in Expand.extractFile Resolves: RHEL-165350...
BIT-PILLOW-2026-59197 Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter calls image.expandsize // 2, size // 2 before rank-filter size validation and...
Out-of-bounds Write
Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the ImageFilter.RankFilter process when a very large odd filter size is provided, leading to unchecked signed integer arithmetic in ImagingExpand. An attacker can cause a heap out-of-bounds write by supplying...
CVE-2026-59197 Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter calls image.expandsize // 2, size // 2 before rank-filter size validation and...