CVE-2024-57256

An integer overflow in ext4fsreadsymlink in Das U-Boot before 2025.01-rc1 occurs for zalloc adding one to an le32 variable via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite...

CVE-2024-57256

CVE-2024-57256 pertains to an integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1. The overflow occurs when zalloc adds one to a 32-bit LE value in crafted ext4 filesystems with an inode size of 0xffffffff, causing a zero malloc and a subsequent memory overwrite. Connected re...

CVE-2024-57258

Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdifft is mishandled on x8664...

CVE-2024-57256

An integer overflow in ext4fsreadsymlink in Das U-Boot before 2025.01-rc1 occurs for zalloc adding one to an le32 variable via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite...

CVE-2024-57257

A stack consumption issue in sqfssize in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting...

CVE-2024-57254

CVE-2024-57254 describes an integer overflow in the sqfs_inode_size calculation within Das U-Boot up to the 2025.01-rc1 release, triggered by a crafted squashfs filesystem affecting the symlink size calculation. Products affected: Das U-Boot (DENX Software Engineering) prior to 2025.01-rc1. Impac...

CVE-2024-57255

An integer overflow in sqfsresolvesymlink in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite...

PT-2025-6742

Name of the Vulnerable Software and Affected Versions Das U-Boot versions prior to 2025.01-rc1 Description An integer overflow occurs in the ext4fs read symlink function in Das U-Boot. This happens when a crafted ext4 filesystem with an inode size of 0xffffffff is used, causing a malloc of zero a...

PT-2025-6740

Name of the Vulnerable Software and Affected Versions Das U-Boot versions prior to 2025.01-rc1 Description The issue is related to an integer overflow in the sqfs inode size function, which occurs during the calculation of the symlink size via a crafted squashfs filesystem. This can be exploited...

PT-2025-6744

Name of the Vulnerable Software and Affected Versions DAS U-Boot versions prior to 2025.01-RC1 Description Integer overflows in memory allocation occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff t is mishandled on x86 64. This issue affects the memory...

PT-2025-6741

Name of the Vulnerable Software and Affected Versions DAS U-Boot versions prior to 2025.01-RC1 Description An integer overflow occurs in the sqfs resolve symlink function in DAS U-Boot through a crafted squashfs filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and a...

SUSE CVE-2022-4510

A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode -e option. Remot...

CVE-2024-31860

Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicatorsE.g .., attackers can see the contents for any files in the filesystem that the server account can access. This issue affects Apache Zeppelin: from 0.9.0 before 0.11.0. Users are recommended to upgrade t...

SUSE CVE-2023-4759

Arbitrary File Overwrite in Eclipse JGit = 6.6.0 In Eclipse JGit, all versions = 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive...

SUSE CVE-2024-10389

There exists a Path Traversal vulnerability in Safearchive on Platforms with Case-Insensitive Filesystems e.g., NTFS. This allows Attackers to Write Arbitrary Files via Archive Extraction containing symbolic links. We recommend upgrading past commit f7ce9d7b6f9c6ecd72d0b0f16216b046e55e44dc...

CVE-2025-1127 Combination Path Traversal and Concurrent Execution vulnerability exists within the embedded web server

The vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user and/or modify the contents of any data on the filesystem...

CVE-2025-1127 Combination Path Traversal and Concurrent Execution vulnerability exists within the embedded web server

The vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user and/or modify the contents of any data on the filesystem...

CVE-2025-1127

CVE-2025-1127 affects Lexmark printers with an embedded web server. Multiple connected sources describe a path traversal combined with concurrent execution vulnerability that allows an unauthenticated attacker to execute arbitrary code as an unprivileged user and/or modify any filesystem data. Re...

UBUNTU-CVE-2025-0927

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Filesystem bugs due to corrupt images are not considered a CVE for any filesystem that is only mountable by CAPSYSADMIN in the initial user namespace. That includes delegated mounting...

CVE-2025-0111

PAN-OS contains an authenticated file read vulnerability in the management web interface that allows a network-authenticated attacker to read files on the PAN-OS filesystem readable by the nobody user. The issue is triggered by access to the management interface; Palo Alto Networks recommends res...