CVE-2019-19203

CVE-2019-19203 Oniguruma 6.x 버전6.9.4rc2 이전에서 문제가 발견되었습니다. gb18030.c 파일의 gb18030mbcenclen 함수에서 UChar 포인터가 일치된 문자열의 끝을 넘었는지 확인하지 않고 역참조됩니다. 이로 인해 힙 기반 버퍼 오버리드가 발생합니다. 연구자: ManhND of The Tarantula Team, VinCSS a member of Vingroup Oniguruma란? Oniguruma는 K. Kosako가 개발한 BSD 라이선스 정규 표현식 라이브러리로, 다양한 문자...

CVE-2019-19203

CVE-2019-19203 Oniguruma 6.x, 6.9.4rc2 이전 버전에서 문제가 발견되었습니다. gb18030.c 파일의 gb18030mbcenclen 함수에서 UChar 포인터가 일치하는 문자열의 끝을 지났는지 확인하지 않고 역참조됩니다. 이로 인해 힙 기반 버퍼 오버리드heap-based buffer over-read가 발생합니다. 연구자: ManhND of The Tarantula Team, VinCSS Vingroup의 계열사 Oniguruma란? K. Kosako가 개발한 Oniguruma는 다양한 문자...

CVE-2025-23134_fixes_code

CVE-2026-34180 – 패치 변경 사항 이 패치는 OpenSSL ASN.1/DER 디코딩 코드의 정수 잘림integer truncation 문제를 해결합니다. 다음과 같은 변경이 이루어졌습니다: 1. ASN.1 콘텐츠 길이 타입 업데이트 asn1exc2i의 len 매개변수를 int에서 long으로 변경했습니다. 이를 통해 함수가 큰 ASN.1 콘텐츠 길이를 즉시 32비트 정수로 잘라내지 않고 수신하고 처리할 수 있습니다. 2. 길이 잘림 검증 추가 len의 int 표현을 담기 위한 ilen 변수를 도입했습니다. 원래의...

CVE-2019-19204

CVE-2019-19204 Oniguruma 6.x 6.9.4rc2 이전에서 문제가 발견되었습니다. regparse.c의 fetchintervalquantifier 함수이전 fetchrangequantifier에서 PFETCH가 PEND 검사 없이 호출됩니다. 이로 인해 힙 기반 버퍼 오버리드heap-based buffer over-read가 발생합니다. 연구자: Vingroup 소속 VinCSS, The Tarantula Team의 ManhND Oniguruma란 무엇인가? K. Kosako가 개발한 Oniguruma는 BS...

CVE-2026-7482

🚨 CVE-2026-7482: Ollama의 힙 버퍼 오버리드Heap Buffer Over-Read 📝 설명 CVE-2026-7482 는 로컬 언어 모델을 실행하기 위한 오픈소스 프레임워크인 Ollama 의 /api/create 및 /api/push 엔드포인트에서 치명적인 힙 버퍼 오버리드Heap Buffer Over-Read 취약점을 식별합니다. 이 취약점은 인증되지 않은 원격 공격자가 프로세스 메모리를 유출 하여 다음과 같은 민감한 데이터를 노출시킬 수 있게 합니다: API 키 및 인증 토큰 환경 변수 시스템 프롬프트 동시...

openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure.

A flaw was found in OpenSSL. An integer truncation vulnerability in the ASN.1 decoder can occur when processing a crafted DER-encoded ASN.1 structure with a primitive element exceeding 2 gigabytes. A remote attacker could exploit this to cause a heap buffer over-read. This may lead to an...

AlmaLinux 9.6 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1782386492)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782386492 advisory. - Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length...

Rocky Linux 8 [CIQ] Security Update: apcu-panel / libzip / libzip-debuginfo / libzip-debugsource / etc Multiple Vulnerabilities (crlsa-2026_2470)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20262470 advisory. php: Leak partial content of the heap through heap buffer over-read in mysqlnd CVE-2024-8929 php: Single byte overread with convert.quoted-printable-decode...

Rocky Linux 9 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-core-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_59362)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202659362 advisory. nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial of service i...

Rocky Linux 8 [CIQ] Security Update: nginx / nginx-all-modules / nginx-debuginfo / nginx-debugsource / etc Multiple Vulnerabilities (crlsa-2026_59216)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202659216 advisory. nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial of service i...

CentOS Linux 7 [TuxCare] Security Update: libsoup / libsoup-devel Multiple Vulnerabilities (CENTOS7:CLSA-2025:1753131065)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2025:1753131065 advisory. - A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skipinsightwhitespace...

Rocky Linux 8 [CIQ] Security Update: apcu-panel / libzip / libzip-debuginfo / libzip-debugsource / etc Multiple Vulnerabilities (crlsa-2025_15687)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202515687 advisory. php: Leak partial content of the heap through heap buffer over-read in mysqlnd CVE-2024-8929 php: Single byte overread with convert.quoted-printable-decod...

Rocky Linux 9 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-core-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_59496)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202659496 advisory. nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial of service i...

Rocky Linux 8 [CIQ] Security Update: libsoup / libsoup-debuginfo / libsoup-debugsource / libsoup-devel Multiple Vulnerabilities (crlsa-2025_8132)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20258132 advisory. libsoup: Heap buffer over-read in skipinsignificantspace when sniffing content CVE-2025-2784 libsoup: Denial of Service attack to websocket server...

AlmaLinux 9.2 [TuxCare] Security Update: libpng / libpng-devel / libpng-static / libpng-tools (ALMALINUX9.2:CLSA-2026:1771001650)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1771001650 advisory. - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files...

Rocky Linux 10.0 [CIQ] Security Update: bsdtar / bsdtar-debuginfo / libarchive / libarchive-debuginfo / etc (crlsa-2025_7510)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20257510 advisory. libarchive: heap buffer over-read in headergnulonglink CVE-2024-57970 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9.6 [TuxCare] Security Update: libpng / libpng-devel / libpng-static / libpng-tools (ALMALINUX9.6:CLSA-2025:1765380269)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1765380269 advisory. - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files...

CentOS Linux 6 [TuxCare] Security Update: openssl / openssl-devel / openssl-perl / openssl-static Multiple Vulnerabilities (CENTOS6:CLSA-2026:1785839292)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1785839292 advisory. - Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if...

CentOS Linux 8.4 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS8.4:CLSA-2026:1785327397)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1785327397 advisory. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcharsetmodule module. When content is served or proxied through a...

Rocky Linux 9 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-core-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_59490)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202659490 advisory. nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial of service i...